Information Leakage Vulnerability in ArcSight ESM and ESM Express by HPE
CVE-2017-13990

5.3MEDIUM

Key Information:

Vendor
HP
Status
Arcsight Enterprise Security Manager
Vendor
CVE Published:
30 September 2017

Summary

An information leakage issue exists in ArcSight ESM and ArcSight ESM Express, exposing sensitive details regarding the underlying Apache Tomcat application server. This vulnerability specifically affects 6.x versions prior to 6.9.1c Patch 4 and 6.11.0 Patch 1, allowing potential attackers to gain access to critical system information that could be leveraged for further exploitation.

References

https://softwaresupport.hpe.com/km/KM02944672
x_refsource_CONFIRM
http://www.securityfocus.com/bid/100935
vdb-entryx_refsource_BID

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.