CVE-2010-3991

Vulnerability

HP Insight Control Server Migration for Windows prior to version 6.2 contains a cross-site scripting (XSS) vulnerability. The issue exists via unspecified vectors, allowing injection of arbitrary web script or HTML. The vulnerability is identified as CVE-2010-3991 and is part of a set of issues disclosed in HP Security Bulletin HPSBMA02601 [1].

Exploitation

An unauthenticated remote attacker can exploit this XSS by crafting a malicious link or input that, when processed by the application, executes arbitrary script in the context of the victim's browser. The attack requires user interaction (e.g., clicking a link) and has medium complexity according to the CVSS score (AV:N/AC:M/Au:N/C:P/I:N/A:N) [1].

Impact

Successful exploitation leads to information disclosure, as the attacker can read sensitive data from the affected web page or session. The CVSS base score is 4.3, indicating a moderate impact on confidentiality only [1].

Mitigation

HP has released version 6.2 of HP Insight Control Server Migration to address this vulnerability. Users should upgrade to this version or later. No workarounds are documented in the available reference [1].