CVE-2016-4360

Critical

Published: 08/06/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Performance Center Virtual Table Server (VTS) component in HPE LoadRunner has a vulnerability that allows remote attackers to delete arbitrary files. The issue is due to unrestricted file path access in unlink calls.

Risk Assessment

An attacker could delete critical system files, leading to significant disruptions in application functionality and potential data loss.

Recommendation

It is recommended to update to the latest version of HPE LoadRunner and Performance Center to mitigate this vulnerability. Access to file deletion functions should also be restricted.

Original NVD description (English source)

web/admin/data.js in the Performance Center Virtual Table Server (VTS) component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.20 through patch 2, and 12.50 through patch 1 do not restrict file paths sent to an unlink call, which allows remote attackers to delete arbitrary files via the path parameter to data/import_csv, aka ZDI-CAN-3555.