cbcvebase.
CVE-2016-4368
published 2016-06-08

CVE-2016-4368: HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote…

PriorityP265critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
4.73%
90.7th percentile
HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected

18 ranges
VendorProductVersion rangeFixed in
hpuniversal_cmbd_configuration_manager——
hpuniversal_cmbd_configuration_manager——
hpuniversal_cmbd_configuration_manager——
hpuniversal_cmbd_configuration_manager——
hpuniversal_cmbd_configuration_manager——
hpuniversal_cmbd_configuration_manager——
hpuniversal_cmbd_foundation——
hpuniversal_cmbd_foundation——
hpuniversal_cmbd_foundation——
hpuniversal_cmbd_foundation——
hpuniversal_cmbd_foundation——
hpuniversal_cmbd_foundation——
hpuniversal_discovery——
hpuniversal_discovery——
hpuniversal_discovery——
hpuniversal_discovery——
hpuniversal_discovery——
hpuniversal_discovery——

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.