Description
Directory traversal vulnerability in OpenView5.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to read arbitrary files via directory traversal sequences in the Action parameter.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- HP OpenView Network Node Manager (OV NNM) 7.x - 'OpenView5.exe?Action' Traversal Arbitrary File Access EDB-31638 · remote · Apr 11, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 1019839 vdb-entry
- hpopenview-openview5-directory-traversal(41790) vdb-entry
- 29796 third-party-advisory
- 20080414 Secunia Research: HP OpenView Network Node Manager OpenView5.exeDirectory Traversal mailing-list
- http://secunia.com/secunia_research/2008-4/advisory/
- 3814 third-party-advisory
- 28745 vdb-entry
- SSRT080043 vendor-advisory
- 44359 vdb-entry
- 20080411 Directory traversal and multiple Denials of Service in HP OpenView NNM 7.53 mailing-list
- ADV-2008-1214 vdb-entry
- 1019838 vdb-entry
- http://aluigi.altervista.org/adv/closedviewx-adv.txt