Vulnerabilities > CVE-2013-2367 - Remote Code Execution vulnerability in HP Sitescope 11.20/11.21
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1678.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |
D2sec
| name | HP SiteScope runOMAgentCommand 11.20 RCE |
| url | http://www.d2sec.com/exploits/hp_sitescope_runomagentcommand_11.20_rce.html |
Exploit-Db
| description | HP SiteScope Remote Code Execution. CVE-2013-2367. Remote exploit for windows platform |
| id | EDB-ID:28188 |
| last seen | 2016-02-03 |
| modified | 2013-09-10 |
| published | 2013-09-10 |
| reporter | metasploit |
| source | https://www.exploit-db.com/download/28188/ |
| title | HP SiteScope Remote Code Execution |
Metasploit
| description | This module exploits a code execution flaw in HP SiteScope. The vulnerability exists in the opcactivate.vbs script, which is reachable from the APIBSMIntegrationImpl AXIS service, and uses WScript.Shell.run() to execute cmd.exe with user provided data. Note that the opcactivate.vbs component is installed with the (optional) HP Operations Agent component. The module has been tested successfully on HP SiteScope 11.20 (with HP Operations Agent) over Windows 2003 SP2. |
| id | MSF:EXPLOIT/WINDOWS/HTTP/HP_SITESCOPE_RUNOMAGENTCOMMAND |
| last seen | 2020-06-11 |
| modified | 2017-07-24 |
| published | 2013-09-04 |
| references | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2367 |
| reporter | Rapid7 |
| source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/http/hp_sitescope_runomagentcommand.rb |
| title | HP SiteScope Remote Code Execution |
Nessus
NASL family CGI abuses NASL id HP_SITESCOPE_RUNOMAGENTCOMMAND.NASL description The version of HP SiteScope hosted on the remote web server has a Windows command injection vulnerability. The application hosts a web service that allows the runOMAgentCommand() method to be invoked without authentication. A remote, unauthenticated attacker could exploit this to run arbitrary Windows commands. last seen 2020-06-01 modified 2020-06-02 plugin id 69983 published 2013-09-19 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69983 title HP SiteScope SOAP Call runOMAgentCommand SOAP Request Arbitrary Remote Code Execution NASL family CGI abuses NASL id HP_SITESCOPE_HPSBGN02904.NASL description The version of HP SiteScope installed on the remote host is potentially affected by the following code execution vulnerabilities : - Unspecified errors exist related to SOAP functionality for which no further details have been provided. (CVE-2013-2367) - An error exists related to handling the SOAP command last seen 2020-06-01 modified 2020-06-02 plugin id 69195 published 2013-08-02 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/69195 title HP SiteScope Multiple Unspecified Remote Code Execution Vulnerabilities
Packetstorm
| data source | https://packetstormsecurity.com/files/download/123153/hp_sitescope_runomagentcommand.rb.txt |
| id | PACKETSTORM:123153 |
| last seen | 2016-12-05 |
| published | 2013-09-09 |
| reporter | rgod |
| source | https://packetstormsecurity.com/files/123153/HP-SiteScope-Remote-Code-Execution.html |
| title | HP SiteScope Remote Code Execution |
Saint
| bid | 61506 |
| description | HP SiteScope APIBSMIntegrationImpl runOMAgentCommand SOAP Request Vulnerability |
| osvdb | 95824 |
| title | hp_sitescope_soap_runomagentcommand |
| type | remote |