Description
An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows unauthorized users to retrieve or modify storage information.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://softwaresupport.hpe.com/km/KM02944672
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/100935
Scores
CVSS v3
8.1
EPSS
0.0034
EPSS Percentile
56.7%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Details
Status
published
Products (18)
hp/arcsight_enterprise_security_manager
6.0
hp/arcsight_enterprise_security_manager
6.0c
hp/arcsight_enterprise_security_manager
6.5 (2 CPE variants)
hp/arcsight_enterprise_security_manager
6.5c (2 CPE variants)
hp/arcsight_enterprise_security_manager
6.8
hp/arcsight_enterprise_security_manager
6.8c
hp/arcsight_enterprise_security_manager
6.9.0c
hp/arcsight_enterprise_security_manager
6.9.1c (4 CPE variants)
hp/arcsight_enterprise_security_manager
6.11.0
hp/arcsight_enterprise_security_manager_express
6.0
... and 8 more
Published
Sep 30, 2017
Tracked Since
Feb 18, 2026