CVE-2016-4360 — CRITICAL (9.1)

Vulnerability Description

web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 do not restrict file paths sent to an unlink call, which allows remote attackers to delete arbitrary files via the path parameter to data/import_csv, aka ZDI-CAN-3555.

CVSS Score

9.1

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Hp	Loadrunner	11.52
Hp	Performance Center	11.52

References

http://www.securityfocus.com/bid/90975
http://www.securitytracker.com/id/1036006Third Party AdvisoryVDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-364Third Party AdvisoryVDB Entry
https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05157423Vendor Advisory
https://www.tenable.com/security/research/tra-2016-17
http://www.securityfocus.com/bid/90975
http://www.securitytracker.com/id/1036006Third Party AdvisoryVDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-16-364Third Party AdvisoryVDB Entry
https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05157423Vendor Advisory
https://www.tenable.com/security/research/tra-2016-17

FAQ

What is CVE-2016-4360?

CVE-2016-4360 is a vulnerability with a CVSS score of 9.1 (CRITICAL). web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50...

How severe is CVE-2016-4360?

CVE-2016-4360 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2016-4360?

Check the references section above for vendor advisories and patch information. Affected products include: Hp Loadrunner, Hp Performance Center.