CVE-2014-2611
Directory traversal vulnerability in the fndwar web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code, or obtain sensitive information or delete data, via unspecified vectors, aka ZDI-CAN-2120.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.9%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Directory traversal vulnerability in the fndwar web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code, or obtain sensitive information or delete data, via unspecified vectors, aka ZDI-CAN-2120.
- CVSS 2.0
- 9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C
- EPSS
- 11.86% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- hp/executive scorecard
- Source
- hp-security-alert@hp.com
References
- http://secunia.com/advisories/59363Third Party Advisory
- http://www.securityfocus.com/bid/68093Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1030439Third Party Advisory, VDB Entry
- http://zerodayinitiative.com/advisories/ZDI-14-210/Third Party Advisory, VDB Entry
- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04341295Vendor Advisory
- http://secunia.com/advisories/59363Third Party Advisory
- http://www.securityfocus.com/bid/68093Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1030439Third Party Advisory, VDB Entry
- http://zerodayinitiative.com/advisories/ZDI-14-210/Third Party Advisory, VDB Entry
- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04341295Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.