HP OpenView Performance Insight Security Bypass and HTML Injection Vulnerabilities

Bugtraq ID:	49096
Class:	Unknown
CVE:	CVE-2011-2406 CVE-2011-2407 CVE-2011-2406 CVE-2011-2407
Remote:	Yes
Local:	No
Published:	Aug 09 2011 12:00AM
Updated:	Mar 19 2015 07:35AM
Credit:	The vendor reported these issues.
Vulnerable:	HP OpenView Performance Insight 5.41.002 HP OpenView Performance Insight 5.41.001 HP OpenView Performance Insight 5.4.1 HP OpenView Performance Insight 5.4 HP OpenView Performance Insight 5.3.1 HP OpenView Performance Insight 5.3
Not Vulnerable:

HP OpenView Performance Insight Security Bypass and HTML Injection Vulnerabilities

HP OpenView Performance Insight is prone to a security-bypass vulnerability and an HTML-injection vulnerability.

An attacker may leverage the HTML-injection issue to inject hostile HTML and script code that would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user.

The attacker may leverage the security-bypass issue to bypass certain security restrictions and perform unauthorized actions in the affected application.

HP OpenView Performance Insight Security Bypass and HTML Injection Vulnerabilities

Attackers can use a browser to exploit the issues.

HP OpenView Performance Insight Security Bypass and HTML Injection Vulnerabilities

Solution:
Vendor updates are available. Please see the references for details.

HP OpenView Performance Insight Security Bypass and HTML Injection Vulnerabilities

References:

• HP Performance Insight software Homepage (HP)
  
• HPSBMU02695 SSRT100480 rev.1 - HP OpenView Performance Insight, Remote HTML Inje (HP)