Vulnerability Details : CVE-2007-6506
The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including 3.0.8.4, allows remote attackers to (1) overwrite and corrupt arbitrary files via arguments to the SaveToFile method, and possibly (2) access arbitrary files via the LoadDataFromFile method.
Exploit prediction scoring system (EPSS) score for CVE-2007-6506
Probability of exploitation activity in the next 30 days: 94.48%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2007-6506
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
References for CVE-2007-6506
-
http://www.securityfocus.com/archive/1/485451/100/0/threaded
-
http://it.slashdot.org/it/07/12/20/2327242.shtml
-
http://www.securityfocus.com/bid/26950
Exploit
-
http://www.securityfocus.com/archive/1/485734/100/0/threaded
-
http://www.securitytracker.com/id?1019133
-
https://www.exploit-db.com/exploits/4757
-
http://www.vupen.com/english/advisories/2007/4271
Vendor Advisory
-
http://www.anspi.pl/~porkythepig/hp-issue/wyfukanyszynszyl.txt
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/39153
-
http://computerworld.com/action/article.do?command=viewArticleBasic&articleId=9053818
-
http://blogs.zdnet.com/security/?p=768
Products affected by CVE-2007-6506
- cpe:2.3:a:hp:software_update:*:*:*:*:*:*:*:*
- cpe:2.3:a:hp:software_update:3.0.8.4:*:*:*:*:*:*:*