CVE-2013-4835

2013-11-0416:55:04

web.nvd.nist.gov

120

nvd

cve-2013-4835

apisitescopeimpl

soap service

hp sitescope

authentication bypass

arbitrary code

remote attackers

zdi-can-1765

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.7

Confidence

Low

EPSS

0.969

Percentile

99.7%

JSON

The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765.

Affected configurations

Nvd

Node

hpsitescopeMatch10.11

hpsitescopeMatch10.13

hpsitescopeMatch11.01

hpsitescopeMatch11.1

hpsitescopeMatch11.10

hpsitescopeMatch11.11

hpsitescopeMatch11.12

hpsitescopeMatch11.20

hpsitescopeMatch11.21

VendorProductVersionCPE
hpsitescope10.11cpe:2.3:a:hp:sitescope:10.11:*:*:*:*:*:*:*
hpsitescope10.13cpe:2.3:a:hp:sitescope:10.13:*:*:*:*:*:*:*
hpsitescope11.01cpe:2.3:a:hp:sitescope:11.01:*:*:*:*:*:*:*
hpsitescope11.1cpe:2.3:a:hp:sitescope:11.1:*:*:*:*:*:*:*
hpsitescope11.10cpe:2.3:a:hp:sitescope:11.10:*:*:*:*:*:*:*
hpsitescope11.11cpe:2.3:a:hp:sitescope:11.11:*:*:*:*:*:*:*
hpsitescope11.12cpe:2.3:a:hp:sitescope:11.12:*:*:*:*:*:*:*
hpsitescope11.20cpe:2.3:a:hp:sitescope:11.20:*:*:*:*:*:*:*
hpsitescope11.21cpe:2.3:a:hp:sitescope:11.21:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hp	sitescope	10.11	cpe:2.3:a:hp:sitescope:10.11:::::::*
hp	sitescope	10.13	cpe:2.3:a:hp:sitescope:10.13:::::::*
hp	sitescope	11.01	cpe:2.3:a:hp:sitescope:11.01:::::::*
hp	sitescope	11.1	cpe:2.3:a:hp:sitescope:11.1:::::::*
hp	sitescope	11.10	cpe:2.3:a:hp:sitescope:11.10:::::::*
hp	sitescope	11.11	cpe:2.3:a:hp:sitescope:11.11:::::::*
hp	sitescope	11.12	cpe:2.3:a:hp:sitescope:11.12:::::::*
hp	sitescope	11.20	cpe:2.3:a:hp:sitescope:11.20:::::::*
hp	sitescope	11.21	cpe:2.3:a:hp:sitescope:11.21:::::::*