CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
8.6 | $0-$5k | 0.00 |
A vulnerability, which was classified as very critical, was found in HP SiteScope up to 11.1. Affected is some unknown processing. The manipulation with an unknown input leads to a remote code execution vulnerability. CWE is classifying the issue as CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:
Session fixation vulnerability in HP SiteScope 9.x, 10.x, and 11.x allows remote attackers to hijack web sessions via unspecified vectors.
The weakness was shared 07/29/2011 (Website). The advisory is available at xforce.iss.net. This vulnerability is traded as CVE-2011-2401. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 11/15/2021).
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
The vulnerability is also documented in the vulnerability database at X-Force (68868). The entry 58133 is related to this item.
Product
Vendor
Name
Version
License
Support
- end of life (old version)
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 8.6VulDB Meta Temp Score: 8.6
VulDB Base Score: 8.6
VulDB Temp Score: 8.6
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Session fixiationCWE: CWE-384
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
OpenVAS ID: 801976
OpenVAS Name: HP SiteScope Cross-Site Scripting and Session Fixation Vulnerabilities
OpenVAS File: 🔍
OpenVAS Family: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: no mitigation knownStatus: 🔍
0-Day Time: 🔍
Timeline
06/06/2011 🔍07/27/2011 🔍
07/28/2011 🔍
07/29/2011 🔍
07/29/2011 🔍
08/08/2011 🔍
03/23/2015 🔍
11/15/2021 🔍
Sources
Vendor: hp.comAdvisory: xforce.iss.net
Status: Not defined
CVE: CVE-2011-2401 (🔍)
IAVM: 🔍
X-Force: 68868
Vulnerability Center: 32600 - HP SiteScope 9.x, 10.x, and 11.x Allows Web Sessions Hijacking, High
SecurityFocus: 48916 - HP SiteScope Unspecified Session Fixation Vulnerability
Secunia: 45440
OSVDB: 74114
See also: 🔍
Entry
Created: 03/23/2015 16:50Updated: 11/15/2021 18:02
Changes: 03/23/2015 16:50 (53), 03/29/2017 11:02 (9), 11/15/2021 17:55 (4), 11/15/2021 18:02 (2)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.