HP Service Manager and Service Center Multiple Vulnerabilities

Bugtraq ID:	48168
Class:	Unknown
CVE:	CVE-2011-1857 CVE-2011-1858 CVE-2011-1859 CVE-2011-1860 CVE-2011-1861 CVE-2011-1862 CVE-2011-1863
Remote:	Yes
Local:	Yes
Published:	Jun 08 2011 12:00AM
Updated:	Jun 08 2011 12:00AM
Credit:	The vendor reported these issues.
Vulnerable:	HP Service Manager 9.21 HP Service Manager 9.20 HP Service Manager 7.11 HP Service Manager 7.02 HP Service Center 6.2.8
Not Vulnerable:

HP Service Manager and Service Center Multiple Vulnerabilities

HP Service Manager and Service Center are prone to cross-site scripting, HTML-injection, security-bypass, and information-disclosure vulnerabilities.

Attackers can exploit these issues to execute arbitrary script code in the context of the website, steal cookie-based authentication information, disclose sensitive information, or bypass certain security restrictions.

HP Service Manager and Service Center Multiple Vulnerabilities

An attacker can exploit these issues through readily available tools. To exploit a cross-site scripting issue, the attacker must entice an unsuspecting victim to follow a malicious URI.

HP Service Manager and Service Center Multiple Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

HP Service Manager and Service Center Multiple Vulnerabilities

References:

• HP ServiceCenter software Homepage (HP)
  
• Service Manager Homepage (HP)
  
• HPSBMA02674 SSRT100487 rev.1 - HP Service Manager and HP Service Center, Unautho ([email protected])
  
• HPSBMA02674 SSRT100487 (HP)