CVE-2013-6221

Related Files

HP AutoPass License Server File Upload

Posted Jun 27, 2014

Authored by rgod, juan vazquez | Site metasploit.com

This Metasploit module exploits a code execution flaw in HP AutoPass License Server. It abuses two weaknesses in order to get its objective. First, the AutoPass application doesn't enforce authentication in the CommunicationServlet component. On the other hand, it's possible to abuse a directory traversal when uploading files thorough the same component, allowing to upload an arbitrary payload embedded in a JSP. The module has been tested successfully on HP AutoPass License Server 8.01 as installed with HP Service Virtualization 3.50.

tags | exploit, arbitrary, code execution

advisories | CVE-2013-6221

SHA-256 | dd2fd87c80023443848e47bf145fc594ce2617436c0759a85eb64c8248dbcdb7

Download | Favorite | View

HP Security Bulletin HPSBMU03045

Posted Jun 12, 2014

Authored by HP | Site hp.com

HP Security Bulletin HPSBMU03045 - A potential security vulnerability has been identified with HP Service Virtualization, running the AutoPass license server. The vulnerability could be exploited remotely to allow code execution. Revision 1 of this advisory.

tags | advisory, code execution

advisories | CVE-2013-6221

SHA-256 | 287138834a5c80ad51a22917a544e825f372744cd37865511bb1d39aa6c49458

Download | Favorite | View