« Volver al listado

CVE-2017-8993

Estado: ModificadaMedia (5.4)—

A Remote Cross-Site Scripting vulnerability in HPE Project and Portfolio Management (PPM) version v9.30, v9.31, v9.32, v9.40 was found.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microfocus — Project AND Portfolio Management

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-8993",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "Hewlett Packard Enterprise",
          "product": "Project and Portfolio Management (PPM)",
          "versions": [
            {
              "status": "affected",
              "version": "v9.30, v9.31, v9.32, v9.40"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-02-15T22:29:09.683",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/100087",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1039065",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbgn03766en_us",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/100087",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1039065",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbgn03766en_us",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Remote Cross-Site Scripting vulnerability in HPE Project and Portfolio Management (PPM) version v9.30, v9.31, v9.32, v9.40 was found."
    },
    {
      "lang": "es",
      "value": "IBM Maximo Asset Management versiones 7.5 y 7.6 podría permitir que un atacante remoto incluya archivos arbitrarios y, como consecuencia, ejecute código en el servidor Web vulnerable. IBM X-Force ID: 129106."
    }
  ],
  "lastModified": "2026-06-17T01:27:19.717",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microfocus:project_and_portfolio_management:9.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4C473C7-52B6-4AB1-B71C-2F4CED7AB1D5"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:project_and_portfolio_management:9.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EEF1692-B5E6-4DDD-8CFD-12AE7ED0C344"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:project_and_portfolio_management:9.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A3C3EE7-40E4-45EA-9624-FF28FF74716F"
            },
            {
              "criteria": "cpe:2.3:a:microfocus:project_and_portfolio_management:9.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBAB4FD1-6A7A-40B7-B0FA-4E5436C369ED"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com"
}