Vulnerability CVE-2010-3290 - CERT Civis.Net

Vulnerability Name:

CVE-2010-3290 (CCN-62680)

Assigned:

2010-10-19

Published:

2010-10-19

Updated:

2017-08-17

Summary:

Unspecified vulnerability in HP Systems Insight Manager (SIM) before 6.2 allows remote authenticated users to gain privileges via unknown vectors.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
4.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Privileges

References:

Source: MITRE
Type: CNA
CVE-2010-3290

Source: HP
Type: Vendor Advisory
HPSBMA02591

Source: CCN
Type: SA41908
HP Systems Insight Manager Multiple Vulnerabilities

Source: CCN
Type: SECTRACK ID: 1024622
HP System Insight Manager Flaws Let Remote Authenticated Users Gain Elevated Privileges and Remote Users Conduct Cross-Site Scripting and Cross-Site Request Forgery Attacks

Source: CCN
Type: OSVDB ID: 68862
HP Systems Insight Manager Unspecified Remote Privilege Escalation (2010-3290)

Source: BID
Type: UNKNOWN
44265

Source: CCN
Type: BID-44265
HP Systems Insight Manager Unspecified Remote Privilege Escalation Vulnerability

Source: SECTRACK
Type: UNKNOWN
1024622

Source: XF
Type: UNKNOWN
hp-sim-unspec-priv-esc(62680)

Source: XF
Type: UNKNOWN
hp-sim-unspec-priv-esc(62680)

Source: CCN
Type: HP Security Bulletin HPSBMA02591 SSRT100299 rev.1
HP Systems Insight Manager (SIM) for HP-UX, Linux, and Windows, Remote Cross Site Request Forgery (CSRF), Cross Site Scripting (XSS), Privilege Escalation

Vulnerable Configuration:

Configuration 1:

cpe:/a:hp:systems_insight_manager:2.5:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:2.5.2.0:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.0:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.0:sp1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.1:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.1:sp1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.2:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.2:sp1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:4.2:sp2:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:sp1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:sp2:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:sp3:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:sp4:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.0:sp5:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.1:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.2:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.2:update_1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.3:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:5.3:update_1:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:6.0:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:*:*:*:*:*:*:*:* (Version <= 6.1)

Configuration CCN 1:

cpe:/a:hp:systems_insight_manager:6.0:*:*:*:*:*:*:*

OR cpe:/a:hp:systems_insight_manager:6.1:*:*:*:*:*:*:*

Denotes that component is vulnerable