CVE-2012-3261

published 2012-09-25

CVE-2012-3261: Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka…

Priority P2 72 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1463.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
hp	sitescope	—	—
hp	sitescope	—	—
hp	sitescope	—	—

Detection & IOCs extracted from sources · hover to see the quote

url APIPreferenceImpl AXIS service (create operation)↗

path UploadManagerServlet↗

• → Monitor for unauthenticated or empty-credential SOAP/AXIS requests to the APIPreferenceImpl service's 'create' operation, which may indicate an authentication bypass attempt. ↗
• → Monitor for JSP file uploads via UploadManagerServlet on HP SiteScope instances, which may indicate payload delivery following auth bypass. ↗
• → The vulnerability is exploitable remotely via the SOAP feature; inspect SOAP traffic to HP SiteScope 11.10–11.12 for anomalous or unexpected payloads. ↗

• · The Metasploit module targets HP SiteScope 11.20 on Windows 2003 SP2 and Linux CentOS 6.3; the CVE itself covers versions 11.10 through 11.12, so exploit reliability may vary across versions. ↗
• · The root vulnerability vector is described as 'unknown vectors' by NVD, limiting precise signature-based detection of the initial SOAP exploitation step. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.