CVE-2016-8525

Vulnerability

The vulnerability is a path traversal in the /rptviewer/servlets/redirectviewer servlet of HPE iMC PLAT. The parafile parameter is not properly validated, allowing directory traversal sequences (e.g., ../) to read arbitrary files. Affected versions include HPE iMC PLAT v7.2 E0403P06 and earlier. The issue was resolved in iMC PLAT 7.3 E0504 or later [1].

Exploitation

An unauthenticated attacker can send a crafted HTTP request to the /rptviewer/servlets/redirectviewer endpoint with a parafile parameter containing path traversal sequences. No authentication or special privileges are required. The attacker can read any file on the system that the iMC process has access to [1].

Impact

Successful exploitation leads to remote disclosure of sensitive information, such as configuration files, credentials, or other data. The attacker gains read access to arbitrary files, compromising confidentiality [1].

Mitigation

HPE released iMC PLAT 7.3 E0504 which fixes the issue. Users should upgrade to that version or later. No workaround is mentioned in the available references. The vulnerability is not listed on CISA KEV [1].