CVE-2008-4560

HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to obtain sensitive information via (1) a crafted request to the nnmRptConfig.exe CGI program, which reveals the pathname of log directories; or (2) a crafted parameter in a request to the ovlaunch.exe CGI program, which reveals configuration details. NOTE: this issue may be partially covered by CVE-2009-0205.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:N/A:N

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01661610	Patch Vendor Advisory
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=771

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hp:openview_network_node_manager:7.0.1::hp_ux:::::
	cpe:2.3:a:hp:openview_network_node_manager:7.0.1::linux:::::
	cpe:2.3:a:hp:openview_network_node_manager:7.0.1::solaris:::::
	cpe:2.3:a:hp:openview_network_node_manager:7.0.1::windows:::::
	cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:::::*
	cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:::::*
	cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:::::*
	cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:::::*
	cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:::::*
	cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:::::*
	cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:::::*
	cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:::::*

History

No history.

Information

Published : 2009-02-08 21:30

Updated : 2023-12-10 10:51

NVD link : CVE-2008-4560

Mitre link : CVE-2008-4560

CVE.ORG link : CVE-2008-4560

JSON object : View

Products Affected

hp

openview_network_node_manager

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2008-4560", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-02-08T21:30:04.733", "references": [{"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01661610", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=771", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to obtain sensitive information via (1) a crafted request to the nnmRptConfig.exe CGI program, which reveals the pathname of log directories; or (2) a crafted parameter in a request to the ovlaunch.exe CGI program, which reveals configuration details. NOTE: this issue may be partially covered by CVE-2009-0205."}, {"lang": "es", "value": "HP OpenView Network Node Manager (OV NNM) v7.01, v7.51, y v7.53, permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de de (1)un petici\u00f3n manipulada al programa CGI nnmRptConfig.exe, que revela la ruta de los directorios de log; o (2) un par\u00e1metro manipulado en una petici\u00f3n al programa CGI ovlaunch.exe, que muestra detalles de la configuraci\u00f3n. NOTA: esta cuesti\u00f3n se encuentra parcialmente tratado en el CVE-2009-0205."}], "lastModified": "2019-10-09T22:56:37.973", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:hp_ux:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A54C04BC-7EA3-412B-B509-414BBC942E92"}, {"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:linux:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EFF07E8-239D-413D-90DB-E3153232D73C"}, {"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:solaris:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D506AC90-5383-4221-BBC8-7AF34D62C929"}, {"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.0.1:*:windows:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16BAE549-664A-47D1-8355-EA63B1BCFD4A"}, {"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.51:-:hp-ux:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6692E05F-4864-449F-8A52-9001028D8C44"}, {"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.51:-:linux:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A40F2C6-AFF9-4D63-ACD0-A9D37160BA3D"}, {"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.51:-:solaris:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC1DA299-A180-4078-9172-67D116840D29"}, {"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.51:-:windows:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FED610E9-7639-48FE-8B4F-B394A7EEC7C9"}, {"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.53:-:hp-ux:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1935DA4-A1AF-4867-BCB1-F5BB75360702"}, {"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.53:-:linux:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "769ED1A5-C3C5-404E-8040-655D69C2AA88"}, {"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.53:-:solaris:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "186EFE05-AC1C-48FF-91B7-0CCD49FEABCC"}, {"criteria": "cpe:2.3:a:hp:openview_network_node_manager:7.53:-:windows:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5CE1F56-FA80-416D-8F42-C1C291F0965C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}