PT-2020-15789 · Hewlett Packard · Hpe Intelligent Management Center

Published 2020-01-29 · Updated 2020-10-21 · CVE-2020-24648

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HPE Intelligent Management Center (iMC) versions prior to 7.3 (E0705P07)

Description A remote code execution vulnerability was discovered due to the deserialization of untrusted data. This issue affects the AccessMgrServlet classname.

Recommendations For versions prior to 7.3 (E0705P07), update to version 7.3 (E0705P07) or later to resolve the issue. As a temporary workaround, consider restricting access to the AccessMgrServlet classname until a patch is available.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-24648

ZDI-19-1036

Affected Products

Hpe Intelligent Management Center

References · 4

• https://osv.dev/vulnerability/CVE-2020-24648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24648 · Security Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04036en_us · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-19-1036 · Security Note