HP Network Node Manager i (NNMi) Software Multiple Unspecified Security Vulnerabilities

Bugtraq ID:	99342
Class:	Input Validation Error
CVE:	CVE-2017-8948
Remote:	Yes
Local:	No
Published:	Jun 30 2017 12:00AM
Updated:	Jun 30 2017 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	HP Network Node Manager I (NNMi) Software 10.20 HP Network Node Manager I (NNMi) Software 10.10 HP Network Node Manager I (NNMi) Software 10.00
Not Vulnerable:	HP Network Node Manager I (NNMi) Software 10.20 Patch 3 HP Network Node Manager I (NNMi) Software 10.10 Patch 4 HP Network Node Manager I (NNMi) Software 10.00 Patch 5

HP Network Node Manager i (NNMi) Software Multiple Unspecified Security Vulnerabilities

HP Network Node Manager i (NNMi) Software is prone to following vulnerabilities:

1. A cross-site scripting vulnerability
2. A security-bypass vulnerability
3. An open-redirect vulnerability

An attacker may leverage these issues to execute HTML and script code in the browser of an unsuspecting user in the context of the affected site, to bypass certain security restrictions and perform unauthorized actions; this may aid in phishing attacks. Other attacks are possible.

HP Network Node Manager i (NNMi) Software versions 10.0x, 10.1x, and 10.2x are vulnerable.

HP Network Node Manager i (NNMi) Software Multiple Unspecified Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HP Network Node Manager i (NNMi) Software Multiple Unspecified Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

HP Network Node Manager i (NNMi) Software Multiple Unspecified Security Vulnerabilities

References:

• HP Homepage (HP)
  
• HPESBGN03762 rev.1 - HPE Network Node Manager i (NNMi) Software, Remote Bypass (HP)