CVE-2015-6030

HP ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3 use the root account to execute files owned by the arcsight user, which might allow local users to gain privileges by leveraging arcsight account access.

Score

CVSS 2.0 7.2 High

Status

Modified - cret@cert.org

Published

2015-11-04

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Arcsight Command Center (Hp)
• Arcsight Connector Appliance (Hp)
• Arcsight Connectors (Hp)
• Arcsight Express (Hp)
• Arcsight Logger (Hp)
• Arcsight Management Center (Hp)
• Arcsight Enterprise Security Manager (Microfocus)

References

• http://www.kb.cert.org/vuls/id/842252
• http://www.securitytracker.com/id/1034072
• http://www.securitytracker.com/id/1034073
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04872416