CVE-2004-1857: HP Web Jetadmin setinfo.hts directory traversal file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

medium priorityThe flaw requires authentication and only yields file read, but public exploit information and a very high EPSS score raise the likelihood of attempted exploitation.

What it is

HP Web Jetadmin 7.5.2546 contains a directory traversal flaw in setinfo.hts, where the setinclude parameter accepts .. sequences. A remote authenticated attacker can use this to read arbitrary files on the host, exposing configuration or credential material.

Impact

An attacker gains read access to files outside the intended web directory, potentially disclosing sensitive configuration or credential data. There is no integrity or availability impact described.

Attack surface

The flaw is reached through the setinfo.hts component and its setinclude parameter; the description states remote authenticated attackers, so valid credentials are required. No user interaction is indicated.

Exploitation

No CISA KEV listing and no ransomware association; EPSS is high at 0.86833 (99.7th percentile), and a reference is tagged Exploit, indicating public exploit information exists.

What to do

• Upgrade or patch HP Web Jetadmin to a version that fixes the setinfo.hts traversal; the record does not name a fixed version, so confirm with HP advisories.
• Restrict network access to the Web Jetadmin interface to trusted management hosts only.
• Enforce least privilege and strong unique credentials for Web Jetadmin accounts to limit authenticated abuse.
• If the product is no longer supported, isolate or retire the instance and migrate to a maintained management platform.

Detection

• Monitor Web Jetadmin HTTP logs for requests to setinfo.hts containing .. or encoded traversal sequences in the setinclude parameter.
• Alert on file read attempts or unusual file access patterns originating from the Web Jetadmin service account.
• Review authentication logs for unexpected or anomalous logins to Web Jetadmin preceding suspicious requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.