CVE-2017-14356

Critical

Published: 31/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An SQL Injection vulnerability exists in HP ArcSight ESM and HP ArcSight ESM Express in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow SQL injection.

Risk Assessment

The organization may be exposed to unauthorized access to data and database manipulation, potentially leading to serious legal and financial consequences.

Recommendation

It is recommended to upgrade to version 6.9.1c Patch 4 or 6.11.0 Patch 1 to mitigate the risk associated with this vulnerability.

Original NVD description (English source)

An SQL Injection vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow SQL injection.