Vulnerability Details : CVE-2016-4372
HPE iMC PLAT before 7.2 E0403P04, iMC EAD before 7.2 E0405P05, iMC APM before 7.2 E0401P04, iMC NTA before 7.2 E0401P01, iMC BIMS before 7.2 E0402P02, and iMC UAM_TAM before 7.2 E0405P05 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
Vulnerability category: Input validation
Products affected by CVE-2016-4372
- cpe:2.3:a:hp:intelligent_management_center_user_access_management:*:*:*:*:*:*:*:*
- cpe:2.3:a:hp:intelligent_management_center_platform:*:*:*:*:*:*:*:*
- cpe:2.3:a:hp:intelligent_management_center_network_traffic_analyzer:*:*:*:*:*:*:*:*
- HP » Intelligent Management Center Branch Intelligent Management SystemVersions up to, including, (<=) 7.2cpe:2.3:a:hp:intelligent_management_center_branch_intelligent_management_system:*:*:*:*:*:*:*:*
- HP » Intelligent Management Center Application Performance ManagerVersions up to, including, (<=) 7.2cpe:2.3:a:hp:intelligent_management_center_application_performance_manager:*:*:*:*:*:*:*:*
- cpe:2.3:a:hp:intelligent_management_center_endpoint_admission_defense:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-4372
4.70%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-4372
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2016-4372
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-4372
-
https://www.exploit-db.com/exploits/42756/
HPE < 7.2 - Java Deserialization
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05200601
HPSBHF03608 rev.1 - HPE iMC PLAT and other Network Products using Apache Java Commons Collection (ACC), Remote Execution of Arbitrary CodeVendor Advisory
-
http://www.securityfocus.com/bid/91739
Multiple HP products CVE-2016-4372 Remote Code Execution Vulnerability
Jump to