Test ID:	1.3.6.1.4.1.25623.1.0.103603
Category:	Web application abuses
Title:	HP SiteScope SOAP Call getSiteScopeConfiguration RCE Vulnerability
Summary:	This vulnerability allows remote attackers to execute arbitrary code on; vulnerable installations of HP SiteScope. Authentication is not required to exploit this vulnerability.
Description:	Summary: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP SiteScope. Authentication is not required to exploit this vulnerability. Vulnerability Insight: The specific flaw exists because HP SiteScope allows unauthenticated SOAP calls to be made to the SiteScope service. One of those calls is getSiteScopeConfiguration() which will return the current configuration of the server including the administrator login and password information. Vulnerability Impact: A remote attacker could abuse this vulnerability to login to SiteScope with administrative privileges then execute arbitrary code through the underlying functionality. Solution: No known solution was made available for at least one year since the disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.