A smsrulesdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
Weakness
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Intelligent_management_center | Hp | * | 7.3 (excluding) |
| Intelligent_management_center | Hp | 7.3 (including) | 7.3 (including) |
| Intelligent_management_center | Hp | 7.3-e0501 (including) | 7.3-e0501 (including) |
| Intelligent_management_center | Hp | 7.3-e0503 (including) | 7.3-e0503 (including) |
| Intelligent_management_center | Hp | 7.3-e0503p02 (including) | 7.3-e0503p02 (including) |
| Intelligent_management_center | Hp | 7.3-e0504 (including) | 7.3-e0504 (including) |
| Intelligent_management_center | Hp | 7.3-e0504p02 (including) | 7.3-e0504p02 (including) |
| Intelligent_management_center | Hp | 7.3-e0504p04 (including) | 7.3-e0504p04 (including) |
| Intelligent_management_center | Hp | 7.3-e0504p2 (including) | 7.3-e0504p2 (including) |
| Intelligent_management_center | Hp | 7.3-e0504p4 (including) | 7.3-e0504p4 (including) |
| Intelligent_management_center | Hp | 7.3-e0506 (including) | 7.3-e0506 (including) |
| Intelligent_management_center | Hp | 7.3-e0506p02 (including) | 7.3-e0506p02 (including) |
| Intelligent_management_center | Hp | 7.3-e0506p03 (including) | 7.3-e0506p03 (including) |
| Intelligent_management_center | Hp | 7.3-e0506p07 (including) | 7.3-e0506p07 (including) |
| Intelligent_management_center | Hp | 7.3-e0506p09 (including) | 7.3-e0506p09 (including) |
| Intelligent_management_center | Hp | 7.3-e0605 (including) | 7.3-e0605 (including) |
| Intelligent_management_center | Hp | 7.3-e0605h02 (including) | 7.3-e0605h02 (including) |
| Intelligent_management_center | Hp | 7.3-e0605h05 (including) | 7.3-e0605h05 (including) |
| Intelligent_management_center | Hp | 7.3-e0605h07 (including) | 7.3-e0605h07 (including) |
| Intelligent_management_center | Hp | 7.3-e0605h08 (including) | 7.3-e0605h08 (including) |
| Intelligent_management_center | Hp | 7.3-e0605h09 (including) | 7.3-e0605h09 (including) |
| Intelligent_management_center | Hp | 7.3-e0605p04 (including) | 7.3-e0605p04 (including) |
| Intelligent_management_center | Hp | 7.3-e0605p06 (including) | 7.3-e0605p06 (including) |
| Intelligent_management_center | Hp | 7.3-e0701 (including) | 7.3-e0701 (including) |
| Intelligent_management_center | Hp | 7.3-e0702 (including) | 7.3-e0702 (including) |
| Intelligent_management_center | Hp | 7.3-e0703 (including) | 7.3-e0703 (including) |
| Intelligent_management_center | Hp | 7.3-e0703h01 (including) | 7.3-e0703h01 (including) |
| Intelligent_management_center | Hp | 7.3-e0705 (including) | 7.3-e0705 (including) |
| Intelligent_management_center | Hp | 7.3-e0705p02 (including) | 7.3-e0705p02 (including) |
Potential Mitigations
- If user-controlled data must be added to an expression interpreter, one or more of the following should be performed:
References
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04036en_us
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbnw04036en_us