HP Network Automation Multiple Unspecified Security Vulnerabilities

Bugtraq ID:	98331
Class:	Design Error
CVE:	CVE-2017-5810 CVE-2017-5811 CVE-2017-5812 CVE-2017-5813 CVE-2017-5814
Remote:	Yes
Local:	No
Published:	May 04 2017 12:00AM
Updated:	May 23 2017 04:23PM
Credit:	rgod and Christophe Schleypen.
Vulnerable:	HP Network Automation 9.10.2 HP Network Automation 9.22.02 HP Network Automation 9.22.01 HP Network Automation 9.22 HP Network Automation 9.20 HP Network Automation 9.10 HP Network Automation 10.20 HP Network Automation 10.11 HP Network Automation 10.10 HP Network Automation 10.00.02 HP Network Automation 10.00.01
Not Vulnerable:

HP Network Automation Multiple Unspecified Security Vulnerabilities

HP Network Automation is prone to following vulnerabilities:

1. An SQL-injection vulnerability.
2. A remote code-execution vulnerability.
3. An information-disclosure vulnerability.
4. Multiple authentication-bypass vulnerabilities.

An attacker may leverage these issues to obtain sensitive information, gain elevated privileges or execute arbitrary code, perform certain unauthorized actions, or exploit latent vulnerabilities in the underlying database.

HP Network Automation versions 9.1x, 9.2x, 10.0x, 10.1x and 10.2x are vulnerable.

HP Network Automation Multiple Unspecified Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HP Network Automation Multiple Unspecified Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

HP Network Automation Multiple Unspecified Security Vulnerabilities

References:

• HP Homepage (HP)
  
• HPESBGN03740 rev.1 - HPE Network Automation, Multiple Remote Vulnerabilities (HP)