PT-2016-5919 · Hewlett Packard+1 · Hp Operations Manager+1

Published 2016-08-01 · Updated 2016-11-28 · CVE-2016-4373

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE Operations Manager (OM) versions prior to 9.21.130

Description The issue allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. This is due to a flaw in the AdminUI component of HPE Operations Manager.

Recommendations For HPE Operations Manager (OM) versions prior to 9.21.130, update to version 9.21.130 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-4373

Affected Products

Apache Commons Collections

Hp Operations Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-4373 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4373 · Vendor Advisory
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05206507 · Vendor Advisory
• http://securityfocus.com/bid/92122 · Note