Lucene search

MitreCVE-2016-4368

HistoryJun 08, 2016 - 2:59 p.m.

CVE-2016-4368

2016-06-0814:59:59

CWE-20

mitre

web.nvd.nist.gov

cve-2016-4368

hpe

universal cmdb

remote code execution

apache commons collections (acc)

security vulnerability

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.006

Percentile

79.1%

JSON

HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected configurations

Nvd

Node

hpuniversal_cmbd_foundationMatch10.0

hpuniversal_cmbd_foundationMatch10.01

hpuniversal_cmbd_foundationMatch10.10

hpuniversal_cmbd_foundationMatch10.11

hpuniversal_cmbd_foundationMatch10.20

hpuniversal_cmbd_foundationMatch10.21

Node

hpuniversal_cmbd_configuration_managerMatch10.0

hpuniversal_cmbd_configuration_managerMatch10.01

hpuniversal_cmbd_configuration_managerMatch10.10

hpuniversal_cmbd_configuration_managerMatch10.11

hpuniversal_cmbd_configuration_managerMatch10.20

hpuniversal_cmbd_configuration_managerMatch10.21

Node

hpuniversal_discoveryMatch10.0

hpuniversal_discoveryMatch10.01

hpuniversal_discoveryMatch10.10

hpuniversal_discoveryMatch10.11

hpuniversal_discoveryMatch10.20

hpuniversal_discoveryMatch10.21

VendorProductVersionCPE
hpuniversal_cmbd_foundation10.0cpe:2.3:a:hp:universal_cmbd_foundation:10.0:*:*:*:*:*:*:*
hpuniversal_cmbd_foundation10.01cpe:2.3:a:hp:universal_cmbd_foundation:10.01:*:*:*:*:*:*:*
hpuniversal_cmbd_foundation10.10cpe:2.3:a:hp:universal_cmbd_foundation:10.10:*:*:*:*:*:*:*
hpuniversal_cmbd_foundation10.11cpe:2.3:a:hp:universal_cmbd_foundation:10.11:*:*:*:*:*:*:*
hpuniversal_cmbd_foundation10.20cpe:2.3:a:hp:universal_cmbd_foundation:10.20:*:*:*:*:*:*:*
hpuniversal_cmbd_foundation10.21cpe:2.3:a:hp:universal_cmbd_foundation:10.21:*:*:*:*:*:*:*
hpuniversal_cmbd_configuration_manager10.0cpe:2.3:a:hp:universal_cmbd_configuration_manager:10.0:*:*:*:*:*:*:*
hpuniversal_cmbd_configuration_manager10.01cpe:2.3:a:hp:universal_cmbd_configuration_manager:10.01:*:*:*:*:*:*:*
hpuniversal_cmbd_configuration_manager10.10cpe:2.3:a:hp:universal_cmbd_configuration_manager:10.10:*:*:*:*:*:*:*
hpuniversal_cmbd_configuration_manager10.11cpe:2.3:a:hp:universal_cmbd_configuration_manager:10.11:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hp	universal_cmbd_foundation	10.0	cpe:2.3:a:hp:universal_cmbd_foundation:10.0:::::::*
hp	universal_cmbd_foundation	10.01	cpe:2.3:a:hp:universal_cmbd_foundation:10.01:::::::*
hp	universal_cmbd_foundation	10.10	cpe:2.3:a:hp:universal_cmbd_foundation:10.10:::::::*
hp	universal_cmbd_foundation	10.11	cpe:2.3:a:hp:universal_cmbd_foundation:10.11:::::::*
hp	universal_cmbd_foundation	10.20	cpe:2.3:a:hp:universal_cmbd_foundation:10.20:::::::*
hp	universal_cmbd_foundation	10.21	cpe:2.3:a:hp:universal_cmbd_foundation:10.21:::::::*
hp	universal_cmbd_configuration_manager	10.0	cpe:2.3:a:hp:universal_cmbd_configuration_manager:10.0:::::::*
hp	universal_cmbd_configuration_manager	10.01	cpe:2.3:a:hp:universal_cmbd_configuration_manager:10.01:::::::*
hp	universal_cmbd_configuration_manager	10.10	cpe:2.3:a:hp:universal_cmbd_configuration_manager:10.10:::::::*
hp	universal_cmbd_configuration_manager	10.11	cpe:2.3:a:hp:universal_cmbd_configuration_manager:10.11:::::::*

Rows per page:

1-10 of 181

References

h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164408

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.006

Percentile

79.1%

JSON

Related for CVE-2016-4368