CVE-2016-4360
First published: Wed Jun 08 2016(Updated: )
web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 do not restrict file paths sent to an unlink call, which allows remote attackers to delete arbitrary files via the path parameter to data/import_csv, aka ZDI-CAN-3555.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HP LoadRunner | =11.52-p3 | |
| HP LoadRunner | =12.00-p1 | |
| HP LoadRunner | =12.01-p3 | |
| HP LoadRunner | =12.02-p2 | |
| HP LoadRunner | =12.50-p3 | |
| OpenText Performance Center | =11.52-p3 | |
| OpenText Performance Center | =12.00-p1 | |
| OpenText Performance Center | =12.01-p3 | |
| OpenText Performance Center | =12.20-p2 | |
| OpenText Performance Center | =12.50-p1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-4360?
CVE-2016-4360 is classified as a medium severity vulnerability.
How do I fix CVE-2016-4360?
To fix CVE-2016-4360, apply the latest security patches provided by HPE for LoadRunner and Performance Center.
What components are affected by CVE-2016-4360?
CVE-2016-4360 affects the Performance Center Virtual Table Server component in multiple versions of HPE LoadRunner and Performance Center.
What types of attacks can exploit CVE-2016-4360?
CVE-2016-4360 may be exploited through cross-site scripting (XSS), allowing attackers to execute scripts in the context of the affected user's session.
Is CVE-2016-4360 still a concern for users of HPE LoadRunner and Performance Center?
Yes, users of affected versions should remain vigilant and apply all necessary patches to mitigate the risks associated with CVE-2016-4360.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/hp
- canonical/hp loadrunner
- version/hp loadrunner/11.52-p3
- version/hp loadrunner/12.00-p1
- version/hp loadrunner/12.01-p3
- version/hp loadrunner/12.02-p2
- version/hp loadrunner/12.50-p3
- canonical/opentext performance center
- version/opentext performance center/11.52-p3
- version/opentext performance center/12.00-p1
- version/opentext performance center/12.01-p3
- version/opentext performance center/12.20-p2
- version/opentext performance center/12.50-p1