HP Systems Insight Manager CVE-2014-2645 Unspecified Clickjacking Vulnerability

Bugtraq ID:	70224
Class:	Design Error
CVE:	CVE-2014-2645
Remote:	Yes
Local:	No
Published:	Oct 02 2014 12:00AM
Updated:	Jan 12 2015 12:02AM
Credit:	The vendor reported this issue.
Vulnerable:	HP Systems Insight Manager 7.0 HP Systems Insight Manager 6.3 HP Systems Insight Manager 6.2 HP Systems Insight Manager 6.1 HP Systems Insight Manager 6.0.0.96 HP Systems Insight Manager 6.0 HP Systems Insight Manager 5.3 HP Systems Insight Manager 5.2 SP2 HP Systems Insight Manager 5.1 SP1 HP Systems Insight Manager 5.0 SP6 HP Systems Insight Manager 5.0 SP5 HP Systems Insight Manager 5.0 SP3 HP Systems Insight Manager 5.0 SP2 HP Systems Insight Manager 5.0 SP1 HP Systems Insight Manager 5.0 HP Systems Insight Manager 4.2 SP2 HP Systems Insight Manager 4.2 SP1 HP Systems Insight Manager 4.2
Not Vulnerable:

HP Systems Insight Manager CVE-2014-2645 Unspecified Clickjacking Vulnerability

HP Systems Insight Manager is prone to an unspecified clickjacking vulnerability because it fails to perform validity checks on certain user actions through HTTP requests.

Successful exploits will allow an attacker to compromise the affected application or obtain sensitive information. Other attacks are also possible.

Versions prior to Systems Insight Manager 7.4 are vulnerable.

HP Systems Insight Manager CVE-2014-2645 Unspecified Clickjacking Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to visit a crafted webpage.

HP Systems Insight Manager CVE-2014-2645 Unspecified Clickjacking Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

HP Systems Insight Manager CVE-2014-2645 Unspecified Clickjacking Vulnerability

References:

• Systems Insight Manager Homepage (HP)