CVE-2016-4405 — Deserialization of Untrusted Data in HP Business Service Management

CWE-502 — Deserialization of Untrusted Data3 documents3 sources

Severity

8.8HIGHNVD

EPSS

15.3%

top 5.35%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

HP Business Service Management Hewlett Packard Enterprise HP Business Service Manager

Timeline

PublishedAug 6

Latest updateMay 14

Description

A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization versions v9.20-v9.26

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDhp/business_service_management9.20 — 9.26

▶CVEListV5hewlett_packard_enterprise/hp_business_service_managerv9.20-v9.26

🔴Vulnerability Details

GHSA

GHSA-7933-ccm5-83cf: A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization vers↗2022-05-14

▶

CVEList

CVE-2016-4405: A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization vers↗2018-08-06

▶