CVE Daily

CVE-2009-3843

HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML fil...

Critical CVSS 10.0

Overview

HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.

CWE: CWE-264 Published: 2009-11-24T00:30:00.420
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 10.0 (CRITICAL)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags