SQL Injection Vulnerability in HP ArcSight ESM and ESM Express
CVE-2017-14356

9.8CRITICAL

Key Information:

Vendor

Micro Focus

Status
HP Arcsight Esm
HP Arcsight Esm Express
Vendor
CVE Published:
31 October 2017

What is CVE-2017-14356?

An SQL Injection vulnerability exists within HP ArcSight ESM and HP ArcSight ESM Express, specifically in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability permits remote attackers to execute arbitrary SQL queries, potentially compromising sensitive data within the database. If exploited, it could lead to unauthorized access and manipulation of the application's database, underscoring the necessity for immediate patching and securing of affected systems.

Affected Version(s)

HP ArcSight ESM Any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1

HP ArcSight ESM Express Any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1

References

https://softwaresupport.hpe.com/km/KM02996760
x_refsource_CONFIRM
https://www.auscert.org.au/bulletins/54166
third-party-advisoryx_refsource_AUSCERT
http://www.securityfocus.com/bid/101627
vdb-entryx_refsource_BID

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.