CVE-2011-0277

2011-02-0901:00:09

CWE-352

[email protected]

web.nvd.nist.gov

cve-2011-0277

cross-site request forgery

csrf

hp power manager

hppm

vulnerability

authentication hijacking

administrators

administrative accounts

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.2 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

67.8%

JSON

Cross-site request forgery (CSRF) vulnerability in HP Power Manager (HPPM) 4.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts.

Affected configurations

NVD

Node

hppower_managerRange≤4.3.2

hppower_managerMatch4.2.5

hppower_managerMatch4.2.6

hppower_managerMatch4.2.7

hppower_managerMatch4.2.8

hppower_managerMatch4.2.9

CPENameOperatorVersion
hp:power_managerhp power managerle4.3.2
hp:power_managerhp power managereq4.2.5
hp:power_managerhp power managereq4.2.6
hp:power_managerhp power managereq4.2.7
hp:power_managerhp power managereq4.2.8
hp:power_managerhp power managereq4.2.9

CPE	Name	Operator	Version
hp:power_manager	hp power manager	le	4.3.2
hp:power_manager	hp power manager	eq	4.2.5
hp:power_manager	hp power manager	eq	4.2.6
hp:power_manager	hp power manager	eq	4.2.7
hp:power_manager	hp power manager	eq	4.2.8
hp:power_manager	hp power manager	eq	4.2.9