CVE-2016-4373

high-risk
Published 2016-08-01

The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Do I need to act?

~
1.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (6)

Operations Manager
Operations Manager
Operations Manager
Operations Manager
Operations Manager
Operations Manager

Affected Vendors

Hp

References (4)

http://www.securityfocus.com/bid/92122
Vendor Advisory https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c...
http://www.securityfocus.com/bid/92122
Vendor Advisory https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c...
50
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 5/34 · Minimal
Exposure 13/34 · Low