NVD Vulnerability Detail

CVE-2011-0276

Summary	HP OpenView Performance Insight Server 5.2, 5.3, 5.31, 5.4, and 5.41 contains a "hidden account" in the com.trinagy.security.XMLUserManager Java class, which allows remote attackers to execute arbitrary code via the doPost method in the com.trinagy.servlet.HelpManagerServlet class.
Publication Date	Feb. 2, 2011, 10 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:23 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:hp:openview_performance_insight:5.2:::::::*
cpe:2.3:a:hp:openview_performance_insight:5.41:::::::*
cpe:2.3:a:hp:openview_performance_insight:5.31:::::::*
cpe:2.3:a:hp:openview_performance_insight:5.4:::::::*
cpe:2.3:a:hp:openview_performance_insight:5.3:::::::*

Related information, measures and tools

No	URL	タグ
1	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02695453	Vendor Advisory
2	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02695453	Vendor Advisory
3	http://osvdb.org/70754
4	http://secunia.com/advisories/43145	Vendor Advisory
5	http://securityreason.com/securityalert/8136
6	http://www.exploit-db.com/exploits/16984
7	http://www.securityfocus.com/archive/1/516093/100/0/threaded
8	http://www.securityfocus.com/bid/46079
9	http://www.securitytracker.com/id?1025014
10	http://www.vupen.com/english/advisories/2011/0258	Vendor Advisory
11	http://www.zerodayinitiative.com/advisories/ZDI-11-034
12	https://exchange.xforce.ibmcloud.com/vulnerabilities/65038
13	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02695453	Vendor Advisory
14	https://exchange.xforce.ibmcloud.com/vulnerabilities/65038
15	http://www.zerodayinitiative.com/advisories/ZDI-11-034
16	http://www.vupen.com/english/advisories/2011/0258	Vendor Advisory
17	http://www.securitytracker.com/id?1025014
18	http://www.securityfocus.com/bid/46079
19	http://www.securityfocus.com/archive/1/516093/100/0/threaded
20	http://www.exploit-db.com/exploits/16984
21	http://securityreason.com/securityalert/8136
22	http://secunia.com/advisories/43145	Vendor Advisory
23	http://osvdb.org/70754
24	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02695453	Vendor Advisory

Common Vulnerabilities List

JVN Vulnerability Information

HP OpenView Performance Insight Server における任意のコードを実行される脆弱性

Title	HP OpenView Performance Insight Server における任意のコードを実行される脆弱性
Summary	HP OpenView Performance Insight Server は、com.trinagy.security.XMLUserManager Java クラスに隠されたアカウントを含むため、任意のコードを実行される脆弱性が存在します。
Possible impacts	第三者により、com.trinagy.servlet.HelpManagerServlet クラス内の doPost メソッドを介して、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 31, 2011, midnight
Registration Date	March 27, 2012, 6:42 p.m.
Last Update	March 27, 2012, 6:42 p.m.

Affected System

ヒューレット・パッカード

openview performance insight 5.2、5.3、5.31、5.4、および 5.41

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0276	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0276
National Vulnerability Database (NVD)
2	CVE-2011-0276	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0276

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-DesignError	https://www.ipa.go.jp/security/vuln/CWE.html#CWEDesignError

ベンダー情報

No	Name	URL
HP
1	HPSBMA02627	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02695453

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.