CVE-2013-6221
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
7.6 High
AI Score
Confidence
Low
0.971 High
EPSS
Percentile
99.8%
Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoPass license server is enabled, allows remote attackers to create arbitrary files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-2031.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| hp:service_virtualization | hp service virtualization | eq | 3.0 |
References
packetstormsecurity.com/files/127247/HP-AutoPass-License-Server-File-Upload.html
www.exploit-db.com/exploits/33891
www.osvdb.org/107943
www.securitytracker.com/id/1030385
zerodayinitiative.com/advisories/ZDI-14-195/
github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_autopass_license_traversal.rb
h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04333125
Related
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
7.6 High
AI Score
Confidence
Low
0.971 High
EPSS
Percentile
99.8%