CVE-2016-4368

HPE Universal CMDB 10.0 through 10.21, Universal CMDB Configuration Manager 10.0 through 10.21, and Universal Discovery 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Published: Jun 8, 2016
Updated: Apr 13, 2023
CVE: CVE-2016-4368
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-20

Affected Software
References

Software	From	Fixed in
hp / universal_cmbd_foundation	10.21	10.21.x
hp / universal_cmbd_foundation	10.01	10.01.x
hp / universal_cmbd_foundation	10.0	10.0.x
hp / universal_cmbd_foundation	10.20	10.20.x
hp / universal_cmbd_foundation	10.11	10.11.x
hp / universal_cmbd_foundation	10.10	10.10.x
hp / universal_cmbd_configuration_manager	10.10	10.10.x
hp / universal_cmbd_configuration_manager	10.11	10.11.x
hp / universal_cmbd_configuration_manager	10.20	10.20.x
hp / universal_cmbd_configuration_manager	10.0	10.0.x
hp / universal_cmbd_configuration_manager	10.21	10.21.x
hp / universal_cmbd_configuration_manager	10.01	10.01.x
hp / universal_discovery	10.10	10.10.x
hp / universal_discovery	10.0	10.0.x
hp / universal_discovery	10.21	10.21.x
hp / universal_discovery	10.11	10.11.x
hp / universal_discovery	10.20	10.20.x
hp / universal_discovery	10.01	10.01.x

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164408

Vulnerability Database

289,784

CVE-2016-4368