HP Insight Control Performance Management CVE-2010-4100 Arbitrary File Download Vulnerability

Bugtraq ID:	44583
Class:	Input Validation Error
CVE:	CVE-2010-4100
Remote:	Yes
Local:	No
Published:	Nov 01 2010 12:00AM
Updated:	Nov 01 2010 12:00AM
Credit:	HP
Vulnerable:
Not Vulnerable:

HP Insight Control Performance Management CVE-2010-4100 Arbitrary File Download Vulnerability

HP Insight Control Performance Management is prone to a vulnerability that lets attackers download arbitrary files.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the application. Information harvested may aid in launching further attacks.

Versions prior to HP Insight Control Performance Management 6.1 update 2 are vulnerable.

HP Insight Control Performance Management CVE-2010-4100 Arbitrary File Download Vulnerability

An attacker can exploit this issue using a browser.

HP Insight Control Performance Management CVE-2010-4100 Arbitrary File Download Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

HP Insight Control Performance Management CVE-2010-4100 Arbitrary File Download Vulnerability

References:

• HP Homepage (HP)
  
• [security bulletin] HPSBMA02600 SSRT100239 rev.1 - HP Insight Control Performanc ([email protected])