CyCLoPs
Micro Focus Expert
Micro Focus Expert
‎2016-06-17 11:41
131 views

SECURITY ALERT - HPE PPM, Remote Disclosure of Sensitive Information, Execution of Arbitrary of Comm

HPSBGN03624 rev.1 - HPE Project and Portfolio Management Center, Remote Disclosure of Sensitive Information, Execution of Arbitrary of Commands

NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2016-06-08

Last Updated: 2016-06-08

Potential Security Impact: Remote Disclosure of Sensitive Information, Execution of Arbitrary Commands

Source: Hewlett Packard Enterprise, HPE Product Security Response Team

VULNERABILITY SUMMARY

A potential vulnerability has been identified in Project and Portfolio Management Center. This vulnerability could be exploited to remotely to allow execution of arbitrary commands and disclosure of sensitive information.

References:

  • CVE-2016-4370
  • PSRT110047

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

HPE Project and Portfolio Management Center 9.20, 9.21, 9.22, 9.30, 9.31, 9.32

BACKGROUND

CVSS 2.0 Base Metrics

RESOLUTION

HPE has provided the following mitigation information to resolve the vulnerability for the impacted versions of HPE Project and Portfolio Management Center:

  • For versions 9.20, 9.21, 9.22 Please update to 9.22.0007  and contact support for a hotfix
  • For versions 9.30, 9.31, 9.32 please Update to 9.32.0002

 

Here are some reference documents for more information related to 9.3x

HPE Project and Portfolio Management Center 9.xx Documentation List

Overview of Project and Portfolio Management 9.3x Releases 

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.