CVE-2008-1663

Vulnerability

HP System Management Homepage (SMH) versions 2.1.10 and 2.1.11 running on Linux and Windows are affected by a cross-site scripting (XSS) vulnerability. The vulnerability is triggered via unspecified vectors, allowing remote attackers to inject arbitrary web script or HTML. [1][2]

Exploitation

An attacker can exploit this vulnerability remotely without authentication. The attack complexity is medium, meaning the attacker must craft a malicious request to inject script into a page served by SMH. User interaction may be required (e.g., clicking a link) due to the XSS nature. The exact vectors are not disclosed. [1][2]

Impact

Successful exploitation allows the attacker to inject arbitrary web script or HTML in the context of the victim's browser. This can lead to partial integrity compromise (e.g., modifying page content or stealing session cookies) and partial confidentiality compromise (e.g., accessing sensitive information). The CVSS base score is 6.4 (Medium) per HP's bulletin. [1]

Mitigation

HP released SMH version 2.1.12 to fix this vulnerability. Users should upgrade to v2.1.12 or later. The update is available from HP's support website. No workaround is provided in the bulletins. [1][2]