NVD

Id
20037  
Name
CVE-2016-4360  
Description
web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 do not restrict file paths sent to an unlink call, which allows remote attackers to delete arbitrary files via the path parameter to data/import_csv, aka ZDI-CAN-3555.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-19  
Published
2016-06-08  
Modified Date
2016-11-28  
Seq
2016-4360  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
109400 20037 CVE-2016-4360 90975  View
109401 20037 CVE-2016-4360 1036006  View
109402 20037 CVE-2016-4360 http://www.tenable.com/security/research/tra-2016-17  View
109403 20037 CVE-2016-4360 http://www.zerodayinitiative.com/advisories/ZDI-16-364  View
109404 20037 CVE-2016-4360 https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05157423  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
2307 JVNDB-2016-003080 HPE LoadRunner および Performance Center におけるデータを変更される脆弱性 HPE LoadRunner および Performance Center には、データを変更される、またはサービス運用妨害 (DoS) 状態にされる脆弱性が存在します。 CVE-2016-4360 90866 CVE-2016-4360 20037 6.4 9.1 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-003080.html 2016-05-31 2016-06-13 View