PT-2016-5914 · Apache+1 · Apache Commons Collections+3

Publicado 2016-06-08 · Atualizado 2016-06-10 · CVE-2016-4368

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE Universal CMDB versions 10.0 through 10.21 HPE Universal CMDB Configuration Manager versions 10.0 through 10.21 HPE Universal Discovery versions 10.0 through 10.21

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Recommendations For HPE Universal CMDB versions 10.0 through 10.21, consider disabling the use of the Apache Commons Collections library until a patch is available. For HPE Universal CMDB Configuration Manager versions 10.0 through 10.21, restrict access to the affected modules to minimize the risk of exploitation. For HPE Universal Discovery versions 10.0 through 10.21, avoid using the vulnerable serialized Java object parameter in the affected API endpoints until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-4368

Produtos afetados

Apache Commons Collections

Hp Universal Cmdb

Hpe Universal Cmdb Configuration Manager

Hpe Universal Discovery

Referências · 3

• https://osv.dev/vulnerability/CVE-2016-4368 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-4368 · Nota de Segurança
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164408 · Aviso do Fabricante