Lucene search

HpeCVE-2016-4392

HistoryAug 06, 2018 - 8:29 p.m.

CVE-2016-4392

2018-08-0620:29:00

CWE-79

hpe

web.nvd.nist.gov

cve-2016-4392

remote

cross site scripting

vulnerability

hp business service management

software

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

41.8%

JSON

A remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1.

Affected configurations

Nvd

Node

hpbusiness_service_managementRange9.20–9.25

hpbusiness_service_managementMatch9.10

hpbusiness_service_managementMatch9.25ip1

VendorProductVersionCPE
hpbusiness_service_management*cpe:2.3:a:hp:business_service_management:*:*:*:*:*:*:*:*
hpbusiness_service_management9.10cpe:2.3:a:hp:business_service_management:9.10:*:*:*:*:*:*:*
hpbusiness_service_management9.25cpe:2.3:a:hp:business_service_management:9.25:ip1:*:*:*:*:*:*

Vendor	Product	Version	CPE
hp	business_service_management	*	cpe:2.3:a:hp:business_service_management::::::::
hp	business_service_management	9.10	cpe:2.3:a:hp:business_service_management:9.10:::::::*
hp	business_service_management	9.25	cpe:2.3:a:hp:business_service_management:9.25:ip1::::::

CNA Affected

[
  {
    "product": "HP Business Service Manager",
    "vendor": "Hewlett Packard Enterprise",
    "versions": [
      {
        "status": "affected",
        "version": "v9.1x, v9.20 - v9.25IP1"
      }
    ]
  }
]

References

www.securityfocus.com/bid/93933

www.securitytracker.com/id/1037127

support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05316329

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

41.8%

JSON

Related for CVE-2016-4392