Description
An information leakage vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1, allows disclosure of Apache Tomcat application server version.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://softwaresupport.hpe.com/km/KM02944672
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/100935
Scores
CVSS v3
5.3
EPSS
0.0055
EPSS Percentile
68.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (18)
hp/arcsight_enterprise_security_manager
6.0
hp/arcsight_enterprise_security_manager
6.0c
hp/arcsight_enterprise_security_manager
6.5 (2 CPE variants)
hp/arcsight_enterprise_security_manager
6.5c (2 CPE variants)
hp/arcsight_enterprise_security_manager
6.8
hp/arcsight_enterprise_security_manager
6.8c
hp/arcsight_enterprise_security_manager
6.9.0c
hp/arcsight_enterprise_security_manager
6.9.1c (4 CPE variants)
hp/arcsight_enterprise_security_manager
6.11.0
hp/arcsight_enterprise_security_manager_express
6.0
... and 8 more
Published
Sep 30, 2017
Tracked Since
Feb 18, 2026