Test ID:	1.3.6.1.4.1.25623.1.0.800293
Category:	Web application abuses
Title:	HP System Management Homepage Cross-site scripting Vulnerability
Summary:	Check for the version of HP SMH
Description:	Overview: This host is running HP System Management Homepage (SMH) and is prone to Cross site scripting vulnerability. Vulnerability Insight: The flaw is caused by an input validation error in the 'proxy/smhui/getuiinfo' script when processing the 'servercert' parameter. Impact: Successful exploitation will allow remote attackers to execute arbitrary script on the user's web browser by injecting web script and steal cookie based authentication credentials. Impact Level: Application. Affected Software : HP System Management Homepage (SMH) versions prior to 6.0 on all platforms. Fix: Upgarde to HP SMH version 6.0.0.96(for windows), 6.0.0-95(for linux), http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02000727 References: http://marc.info/?l=bugtraq&m=126529736830358&w=2 http://www.vupen.com/english/advisories/2010/0294 http://www.securityfocus.com/archive/1/archive/1/509195/100/0/threaded
Cross-Ref:	BugTraq ID: 38081 Common Vulnerability Exposure (CVE) ID: CVE-2009-4185 Bugtraq: 20100127 PR09-15: XSS injection vulnerability within HP System Management Homepage (Insight Manager) (Google Search) http://www.securityfocus.com/archive/1/archive/1/509195/100/0/threaded http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-15 HPdes Security Advisory: HPSBMA02504 http://marc.info/?l=bugtraq&m=126529736830358&w=2 HPdes Security Advisory: SSRT090220 http://www.securityfocus.com/bid/38081 http://www.securitytracker.com/id?1023541 http://secunia.com/advisories/38341 http://www.vupen.com/english/advisories/2010/0294
Copyright	Copyright (C) 2010 Greenbone Networks GmbH

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: