Software Engineering Institute

HP StorageWorks P2000 G3 contains an embedded webserver which is vulnerable to a directory traversal vulnerability which may allow a remote, unauthenticated attacker to obtain sensitive information.

This vulnerability was also reported to ZDI by another researcher and was disclosed publicly.

A remote unauthenticated attacker could obtain sensitive information.

Apply Update

The vendor has reported this issue has been addressed in the TS230P008 firmware.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing a HP StorageWorks P2000 G3 using stolen credentials from a blocked network location.