CVE-2011-0276 HP OpenView Performance Insight Server 5.2, 5.3, 5.31, 5.4, and 5.41 contains a "hidden account" in the com.trinagy.security.XMLUserManager Java class, which allows remote attackers to execute arbitra...
HighCVSS 10.0
EPSS 82.4%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
HP OpenView Performance Insight Server 5.2, 5.3, 5.31, 5.4, and 5.41 contains a "hidden account" in the com.trinagy.security.XMLUserManager Java class, which allows remote attackers to execute arbitrary code via the doPost method in the com.trinagy.servlet.HelpManagerServlet class.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| HP Inc openview performance insight | = 5.2 | No fix listed |
| HP Inc openview performance insight | = 5.3 | No fix listed |
| HP Inc openview performance insight | = 5.4 | No fix listed |
| HP Inc openview performance insight | = 5.31 | No fix listed |
| HP Inc openview performance insight | = 5.41 | No fix listed |
References
- SSRT090246 vendor-advisory
- 70754 vdb-entry
- 43145 third-party-advisory vendor-advisory
- 8136 third-party-advisory
- 16984 exploit
- 20110131 ZDI-11-034: HP OpenView Performance Insight Server Backdoor Account Code Execution Vulnerability mailing-list
- 46079 vdb-entry
- 1025014 vdb-entry
- ADV-2011-0258 vdb-entry vendor-advisory
- www.zerodayinitiative.com
- openview-dopost-code-execution(65038) vdb-entry