PT-2016-1644 · Hewlett Packard+1 · Asset Manager Cloudsystem Chargeback+2

Published 2016-04-05 · Updated 2016-12-01 · CVE-2016-2000

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE Asset Manager versions 9.40 through 9.50 Asset Manager CloudSystem Chargeback version 9.40

Description The issue is related to incorrect data processing, allowing a remote attacker to execute arbitrary commands using a specially crafted serialized Java object associated with the Apache Commons Collections library.

Recommendations For HPE Asset Manager versions 9.40 through 9.50, consider disabling the use of the Apache Commons Collections library until a patch is available. For Asset Manager CloudSystem Chargeback version 9.40, restrict access to the vulnerable module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-19

Related Identifiers

BDU:2016-00956

CVE-2016-2000

Affected Products

Apache Commons Collections

Asset Manager Cloudsystem Chargeback

Hp Assetmanager

References · 5

• https://osv.dev/vulnerability/CVE-2016-2000 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00956 · Security Note
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05064889 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2000 · Security Note
• https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05064889 · Note