CVE-2016-4360

published 2016-06-08

CVE-2016-4360: web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through…

Priority P3 58 critical 9.1 CVSS 3.0

AV N AC L PR N UI N S U C N I H A H

web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 do not restrict file paths sent to an unlink call, which allows remote attackers to delete arbitrary files via the path parameter to data/import_csv, aka ZDI-CAN-3555.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
hp	loadrunner	—	—
hp	loadrunner	—	—
hp	loadrunner	—	—
hp	loadrunner	—	—
hp	loadrunner	—	—
hp	performance_center	—	—
hp	performance_center	—	—
hp	performance_center	—	—
hp	performance_center	—	—
hp	performance_center	—	—

CVSS provenance

nvd v3.0 9.1 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

nvd v2.0 6.4 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.