CVE-2016-4368 HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a cr...
CriticalCVSS 9.8
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| HP Inc universal cmbd foundation | = 10.0 | No fix listed |
| HP Inc universal cmbd foundation | = 10.01 | No fix listed |
| HP Inc universal cmbd foundation | = 10.10 | No fix listed |
| HP Inc universal cmbd foundation | = 10.11 | No fix listed |
| HP Inc universal cmbd foundation | = 10.20 | No fix listed |
| HP Inc universal cmbd foundation | = 10.21 | No fix listed |
| HP Inc universal cmbd configuration manager | = 10.0 | No fix listed |
| HP Inc universal cmbd configuration manager | = 10.01 | No fix listed |
| HP Inc universal cmbd configuration manager | = 10.10 | No fix listed |
| HP Inc universal cmbd configuration manager | = 10.11 | No fix listed |
| HP Inc universal cmbd configuration manager | = 10.20 | No fix listed |
| HP Inc universal cmbd configuration manager | = 10.21 | No fix listed |
| HP Inc universal discovery | = 10.0 | No fix listed |
| HP Inc universal discovery | = 10.01 | No fix listed |
| HP Inc universal discovery | = 10.10 | No fix listed |
| HP Inc universal discovery | = 10.11 | No fix listed |
| HP Inc universal discovery | = 10.20 | No fix listed |
| HP Inc universal discovery | = 10.21 | No fix listed |
References
- h20566.www2.hpe.com vendor-advisory