CVE-2010-0452

Vulnerability

HP Project and Portfolio Management Center (PPMC, formerly Mercury IT Governance) versions 7.1 through SP10 and 7.5 through SP3 running on AIX, HP-UX, Red Hat Linux, SUSE Linux, Solaris, and Windows Server are affected by multiple cross-site scripting (XSS) vulnerabilities [1]. The flaw allows remote attackers to inject arbitrary web script or HTML via unspecified vectors [1].

Exploitation

An attacker can remotely exploit this vulnerability without authentication, but user interaction is required (e.g., a victim must click a crafted link or visit a malicious page) [1]. The attacker needs no special network position beyond standard web access to the application [1].

Impact

Successful exploitation leads to disclosure of sensitive information (e.g., session cookies or other data) within the context of the victim's browser session [1]. The CVSS base score is 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) [1].

Mitigation

HP has released software patches to resolve the vulnerability; they are available from the HP Software Support Online (SSO) portal [1]. Users should apply the appropriate patch for their version and platform. No workarounds are documented in the available references [1].