PT-2016-1644 · Hewlett Packard+1 · Asset Manager Cloudsystem Chargeback+2

Publicado 2016-04-05 · Atualizado 2016-12-01 · CVE-2016-2000

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE Asset Manager versions 9.40 through 9.50 Asset Manager CloudSystem Chargeback version 9.40

Description The issue is related to incorrect data processing, allowing a remote attacker to execute arbitrary commands using a specially crafted serialized Java object associated with the Apache Commons Collections library.

Recommendations For HPE Asset Manager versions 9.40 through 9.50, consider disabling the use of the Apache Commons Collections library until a patch is available. For Asset Manager CloudSystem Chargeback version 9.40, restrict access to the vulnerable module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

BDU:2016-00956

CVE-2016-2000

Produtos afetados

Apache Commons Collections

Asset Manager Cloudsystem Chargeback

Hp Assetmanager

Referências · 5

• https://osv.dev/vulnerability/CVE-2016-2000 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-00956 · Nota de Segurança
• https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05064889 · Nota
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05064889 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-2000 · Nota de Segurança