Vulnerability Details : CVE-2013-2367
Public exploit exists!
Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1678.
Vulnerability category: Execute code
Exploit prediction scoring system (EPSS) score for CVE-2013-2367
Probability of exploitation activity in the next 30 days: 94.95%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2013-2367
-
HP SiteScope Remote Code Execution
Disclosure Date: 2013-07-29First seen: 2020-04-26exploit/windows/http/hp_sitescope_runomagentcommandThis module exploits a code execution flaw in HP SiteScope. The vulnerability exists in the opcactivate.vbs script, which is reachable from the APIBSMIntegrationImpl AXIS service, and uses WScript.Shell.run() to execute cmd.exe with user provided data. Note
CVSS scores for CVE-2013-2367
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
References for CVE-2013-2367
-
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03861260
HP Support for Technical Help and Troubleshooting | HP® Customer Service.Vendor Advisory
Products affected by CVE-2013-2367
- cpe:2.3:a:hp:sitescope:11.20:*:*:*:*:*:*:*
- cpe:2.3:a:hp:sitescope:11.21:*:*:*:*:*:*:*