CVE-2007-5413

HP OpenView Configuration Management 4.0-4.2i - Unauthenticated Arbitrary File Read via Tilde Path Traversal

Title source: llm
STIX 2.1

Description

httpd.tkd in Radia Integration Server in Hewlett-Packard (HP) OpenView Configuration Management (CM) Infrastructure 4.0 through 4.2i and Client Configuration Manager (CCM) 2.0 allows remote attackers to read arbitrary files via URLs containing tilde (~) references to home directories, as demonstrated by ~root.

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/483106/100/100/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/39528
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/37400
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-07-060.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1018858
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27341
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/3620

Scores

EPSS 0.0083
EPSS Percentile 74.8%

Details

CWE
CWE-200
Status published
Products (5)
hp/openview_client_configuraton_manager 2.0
hp/openview_configuration_management 4.0 (5 CPE variants)
hp/openview_configuration_management 4.1 (5 CPE variants)
hp/openview_configuration_management 4.2 (5 CPE variants)
hp/openview_configuration_management 4.2i (5 CPE variants)
Published Oct 29, 2007
Tracked Since Feb 18, 2026