CVE-2013-6221

EPSS 77.9%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 77.9%KEV nãoPoC públicaNuclei —Metasploit simPatch referenciado

Lifecycle

10 Jan 2014Metasploit module available

18 Jun 2014Published on NVD

27 Jun 2014Public PoC

Weaponization speed

8 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoPass license server is enabled, allows remote attackers to create arbitrary files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-2031.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/127247/HP-AutoPass-License-Server-File-Upload.htmlunverified cve_referencewww.exploit-db.com/exploits/33891unverified exploitdbwww.exploit-db.com/exploits/33891unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/127247/HP-AutoPass-License-Server-File-Upload.html https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/hp_autopass_license_traversal.rb https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04333125 http://www.exploit-db.com/exploits/33891 http://www.osvdb.org/107943 http://www.securitytracker.com/id/1030385 http://zerodayinitiative.com/advisories/ZDI-14-195/