CVE-2017-13991: Infoleak
Published Sep 29, 2017
·Updated
An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of product license features.
Affected Software
28 affected components
HP Arcsight Enterprise Security Manager=6.0
HP Arcsight Enterprise Security Manager=6.0c
HP Arcsight Enterprise Security Manager=6.5
HP Arcsight Enterprise Security Manager=6.5-sp1
HP Arcsight Enterprise Security Manager=6.5c
HP Arcsight Enterprise Security Manager=6.5c-sp1
HP Arcsight Enterprise Security Manager=6.8
HP Arcsight Enterprise Security Manager=6.8c
HP Arcsight Enterprise Security Manager=6.9.0c
HP Arcsight Enterprise Security Manager=6.9.1c
HP Arcsight Enterprise Security Manager=6.9.1c-p1
HP Arcsight Enterprise Security Manager=6.9.1c-p2
HP Arcsight Enterprise Security Manager=6.9.1c-p3
HP Arcsight Enterprise Security Manager=6.11.0
HP Arcsight Enterprise Security Manager Express=6.0
HP Arcsight Enterprise Security Manager Express=6.0c
HP Arcsight Enterprise Security Manager Express=6.5
HP Arcsight Enterprise Security Manager Express=6.5-sp1
HP Arcsight Enterprise Security Manager Express=6.5c
HP Arcsight Enterprise Security Manager Express=6.5c-sp1
HP Arcsight Enterprise Security Manager Express=6.8
HP Arcsight Enterprise Security Manager Express=6.8c
HP Arcsight Enterprise Security Manager Express=6.9.0
HP Arcsight Enterprise Security Manager Express=6.9.1c
HP Arcsight Enterprise Security Manager Express=6.9.1c-p1
HP Arcsight Enterprise Security Manager Express=6.9.1c-p2
HP Arcsight Enterprise Security Manager Express=6.9.1c-p3
HP Arcsight Enterprise Security Manager Express=6.11.0
Event History
Sep 29, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-13991?
CVE-2017-13991 has been classified as a medium severity vulnerability due to its information leakage potential.
2
How do I fix CVE-2017-13991?
To fix CVE-2017-13991, upgrade to ArcSight ESM version 6.9.1c Patch 4 or 6.11.0 Patch 1 or later.
3
Which versions of ArcSight ESM are affected by CVE-2017-13991?
CVE-2017-13991 affects all ArcSight ESM versions prior to 6.9.1c Patch 4 and 6.11.0 Patch 1.
4
What type of information is leaked by CVE-2017-13991?
CVE-2017-13991 allows for the disclosure of product license features.
5
Is ArcSight ESM Express also affected by CVE-2017-13991?
Yes, CVE-2017-13991 also affects certain versions of ArcSight ESM Express prior to the same patches.