CVE-2016-4360: Critical severity hp loadrunner vulnerability
web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 do not restrict file paths sent to an unlink call, which allows remote attackers to delete arbitrary files via the path parameter to data/importcsv, aka ZDI-CAN-3555.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4360?
CVE-2016-4360 is classified as a medium severity vulnerability.
How do I fix CVE-2016-4360?
To fix CVE-2016-4360, apply the latest security patches provided by HPE for LoadRunner and Performance Center.
What components are affected by CVE-2016-4360?
CVE-2016-4360 affects the Performance Center Virtual Table Server component in multiple versions of HPE LoadRunner and Performance Center.
What types of attacks can exploit CVE-2016-4360?
CVE-2016-4360 may be exploited through cross-site scripting (XSS), allowing attackers to execute scripts in the context of the affected user's session.
Is CVE-2016-4360 still a concern for users of HPE LoadRunner and Performance Center?
Yes, users of affected versions should remain vigilant and apply all necessary patches to mitigate the risks associated with CVE-2016-4360.