Vulnerability Details : CVE-2013-4835
Public exploit exists!
The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765.
Vulnerability category: Execute code
Products affected by CVE-2013-4835
- cpe:2.3:a:hp:sitescope:10.13:*:*:*:*:*:*:*
- cpe:2.3:a:hp:sitescope:11.01:*:*:*:*:*:*:*
- cpe:2.3:a:hp:sitescope:11.1:*:*:*:*:*:*:*
- cpe:2.3:a:hp:sitescope:11.11:*:*:*:*:*:*:*
- cpe:2.3:a:hp:sitescope:11.12:*:*:*:*:*:*:*
- cpe:2.3:a:hp:sitescope:11.10:*:*:*:*:*:*:*
- cpe:2.3:a:hp:sitescope:11.20:*:*:*:*:*:*:*
- cpe:2.3:a:hp:sitescope:11.21:*:*:*:*:*:*:*
- cpe:2.3:a:hp:sitescope:10.11:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-4835
96.95%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2013-4835
-
HP SiteScope issueSiebelCmd Remote Code Execution
Disclosure Date: 2013-10-30First seen: 2020-04-26exploit/multi/http/hp_sitescope_issuesiebelcmdThis module exploits a code execution flaw in HP SiteScope. The vulnerability exists in the APISiteScopeImpl web service, specifically in the issueSiebelCmd method, which allows the user to execute arbitrary commands without authentication. This module has been tested
CVSS scores for CVE-2013-4835
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2013-4835
-
http://www.exploit-db.com/exploits/30473
HP SiteScope issueSiebelCmd - Remote Code Execution (Metasploit) - Unix remote Exploit
-
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03969435
HP Support for Technical Help and Troubleshooting | HP® Customer Service.Vendor Advisory
-
https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03969435
HPSBMU02933 rev.3 - HPE SiteScope, issueSiebelCmd and loadFileContents SOAP Requests, Remote Code Execution, Arbitrary File download, Denial of Service (DoS)
Jump to