CVE-2016-4371

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-4371
HPE Service Manager Software 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote authenticated users to obtain sensitive information, modify data, and conduct server-side request forgery (SSRF) attacks via unspecified vectors, related to the Server, Web Client, Windows Client, and Service Request components.

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability : 2.1 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05167176 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:hp:service_manager:9.30:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager:9.31:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager:9.32:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager:9.33:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager:9.34:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager:9.35:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager:9.40:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager:9.41:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_mobility:9.30:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_mobility:9.31:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_mobility:9.32:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_mobility:9.33:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_mobility:9.34:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_mobility:9.35:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_mobility:9.40:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_mobility:9.41:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_server:9.30:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_server:9.31:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_server:9.32:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_server:9.33:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_server:9.34:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_server:9.35:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_server:9.40:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_server:9.41:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_service_request_catalog:9.30:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_service_request_catalog:9.31:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_service_request_catalog:9.32:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_service_request_catalog:9.33:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_service_request_catalog:9.34:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_service_request_catalog:9.35:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_service_request_catalog:9.40:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_service_request_catalog:9.41:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_web_client:9.30:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_web_client:9.31:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_web_client:9.32:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_web_client:9.33:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_web_client:9.34:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_web_client:9.35:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_web_client:9.40:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_web_client:9.41:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_windows_client:9.30:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_windows_client:9.31:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_windows_client:9.32:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_windows_client:9.33:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_windows_client:9.34:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_windows_client:9.35:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_windows_client:9.40:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_manager_windows_client:9.41:*:*:*:*:*:*:*
History

No history.

Information

Published : 2016-06-19 01:59

Updated : 2024-02-04 18:53

NVD link : CVE-2016-4371

Mitre link : CVE-2016-4371

CVE.ORG link : CVE-2016-4371

JSON object : View

Products Affected

hp

  • service_manager_windows_client
  • service_manager_mobility
  • service_manager_server
  • service_manager
  • service_manager_web_client
  • service_manager_service_request_catalog
CWE
CWE-352

Cross-Site Request Forgery (CSRF)