HP Insight Control Power Management Unspecified Cross Site Request Forgery Vulnerability

Bugtraq ID:	44436
Class:	Design Error
CVE:	CVE-2010-4024
Remote:	Yes
Local:	No
Published:	Oct 25 2010 12:00AM
Updated:	Oct 25 2010 12:00AM
Credit:	Reported by the vendor
Vulnerable:	HP HP Insight Control Power Management 6.0
Not Vulnerable:	HP HP Insight Control Power Management 6.2

HP Insight Control Power Management Unspecified Cross Site Request Forgery Vulnerability

HP Insight Control Power Management is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible.

Versions prior to HP Insight Control Power Management v6.2 on Microsoft Windows are vulnerable.

HP Insight Control Power Management Unspecified Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into visiting a malicious webpage.

HP Insight Control Power Management Unspecified Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references for more information.

HP Insight Control Power Management Unspecified Cross Site Request Forgery Vulnerability

References:

• HP Insight Control power management software - Homepage (HP)
  
• [security bulletin] HPSBMA02603 SSRT100319 rev.1 - HP Insight Control Power Mana ([email protected])
  
• HPSBMA02603 SSRT100319 rev.1 - HP Insight Control Power Management for Windows, (HP)