ZDI-CAN-14056: Hewlett Packard Enterprise iLO Amplifier Pack backup Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hewlett Packard Enterprise iLO Amplifier Pack. Authentication is not required to exploit this vulnerability. The specific flaw exists within the backup endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-14056?
ZDI-CAN-14056 is considered a high severity vulnerability due to its potential to allow remote code execution without authentication.
How do I fix ZDI-CAN-14056?
To mitigate ZDI-CAN-14056, update the Hewlett Packard Enterprise iLO Amplifier Pack to the latest version as recommended by the vendor.
What types of systems are affected by ZDI-CAN-14056?
ZDI-CAN-14056 affects installations of Hewlett Packard Enterprise iLO Amplifier Pack.
Can ZDI-CAN-14056 be exploited remotely?
Yes, ZDI-CAN-14056 can be exploited remotely without requiring authentication.
What is the potential impact of ZDI-CAN-14056?
The potential impact of ZDI-CAN-14056 includes unauthorized remote code execution, which could compromise the affected system.