CVE-2016-4368 — Improper Input Validation in HP Universal Cmbd Configuration Manager

CWE-20 — Improper Input Validation3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
1.2%
top 20.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
HP Universal Cmbd Configuration ManagerHP Universal Cmbd FoundationHP Universal Discovery
Timeline
PublishedJun 8
Latest updateMay 17

Description

HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDhp/universal_discovery6 versions+5

🔴Vulnerability Details

2
GHSA
GHSA-3p42-7grr-wj6x: HPE Universal CMDB 10↗2022-05-17
▶
CVEList
CVE-2016-4368: HPE Universal CMDB 10↗2016-06-08
▶
CVE-2016-4368 — Improper Input Validation in HP | cvebase