CVE-2013-4810

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-09-09T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-10-04T09:57:01.000Z", "orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp"}, "references": [{"name": "HPSBPV02918", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409"}, {"name": "28713", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/28713/"}, {"name": "SSRT101127", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409"}, {"tags": ["x_refsource_MISC"], "url": "http://zerodayinitiative.com/advisories/ZDI-13-229/"}, {"name": "HPSBGN03323", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2"}, {"name": "1029010", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1029010"}, {"name": "HPSBGN02952", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=138696448823753&w=2"}, {"name": "54788", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/54788"}, {"name": "SSRT102036", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "hp-security-alert@hp.com", "ID": "CVE-2013-4810", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "HPSBPV02918", "refsource": "HP", "url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409"}, {"name": "28713", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/28713/"}, {"name": "SSRT101127", "refsource": "HP", "url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409"}, {"name": "http://zerodayinitiative.com/advisories/ZDI-13-229/", "refsource": "MISC", "url": "http://zerodayinitiative.com/advisories/ZDI-13-229/"}, {"name": "HPSBGN03323", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2"}, {"name": "1029010", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1029010"}, {"name": "HPSBGN02952", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=138696448823753&w=2"}, {"name": "54788", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/54788"}, {"name": "SSRT102036", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T16:52:27.256Z"}, "title": "CVE Program Container", "references": [{"name": "HPSBPV02918", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409"}, {"name": "28713", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/28713/"}, {"name": "SSRT101127", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://zerodayinitiative.com/advisories/ZDI-13-229/"}, {"name": "HPSBGN03323", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2"}, {"name": "1029010", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1029010"}, {"name": "HPSBGN02952", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=138696448823753&w=2"}, {"name": "54788", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/54788"}, {"name": "SSRT102036", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2"}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2013-4810", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-07T13:46:26.369798Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-03-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-4810"}}}], "references": [{"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-4810", "tags": ["government-resource"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "timeline": [{"time": "2022-03-25T00:00:00.000Z", "lang": "en", "value": "CVE-2013-4810 added to CISA KEV"}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T00:05:40.935Z"}}]}, "cveMetadata": {"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "assignerShortName": "hp", "cveId": "CVE-2013-4810", "datePublished": "2013-09-13T18:00:00.000Z", "dateReserved": "2013-07-12T00:00:00.000Z", "dateUpdated": "2025-10-22T00:05:40.935Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409", "name": "HPSBPV02918", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"]}, {"url": "https://www.exploit-db.com/exploits/28713/", "name": "28713", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"]}, {"url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409", "name": "SSRT101127", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"]}, {"url": "http://zerodayinitiative.com/advisories/ZDI-13-229/", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2", "name": "HPSBGN03323", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"]}, {"url": "http://www.securitytracker.com/id/1029010", "name": "1029010", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"]}, {"url": "http://marc.info/?l=bugtraq&m=138696448823753&w=2", "name": "HPSBGN02952", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"]}, {"url": "http://secunia.com/advisories/54788", "name": "54788", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"]}, {"url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2", "name": "SSRT102036", "tags": ["vendor-advisory", "x_refsource_HP", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T16:52:27.256Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2013-4810", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-07T13:46:26.369798Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-03-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-4810"}}}], "timeline": [{"lang": "en", "time": "2022-03-25T00:00:00.000Z", "value": "CVE-2013-4810 added to CISA KEV"}], "references": [{"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-4810", "tags": ["government-resource"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-07T13:46:16.988Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-09-09T00:00:00.000Z", "references": [{"url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409", "name": "HPSBPV02918", "tags": ["vendor-advisory", "x_refsource_HP"]}, {"url": "https://www.exploit-db.com/exploits/28713/", "name": "28713", "tags": ["exploit", "x_refsource_EXPLOIT-DB"]}, {"url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409", "name": "SSRT101127", "tags": ["vendor-advisory", "x_refsource_HP"]}, {"url": "http://zerodayinitiative.com/advisories/ZDI-13-229/", "tags": ["x_refsource_MISC"]}, {"url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2", "name": "HPSBGN03323", "tags": ["vendor-advisory", "x_refsource_HP"]}, {"url": "http://www.securitytracker.com/id/1029010", "name": "1029010", "tags": ["vdb-entry", "x_refsource_SECTRACK"]}, {"url": "http://marc.info/?l=bugtraq&m=138696448823753&w=2", "name": "HPSBGN02952", "tags": ["vendor-advisory", "x_refsource_HP"]}, {"url": "http://secunia.com/advisories/54788", "name": "54788", "tags": ["third-party-advisory", "x_refsource_SECUNIA"]}, {"url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2", "name": "SSRT102036", "tags": ["vendor-advisory", "x_refsource_HP"]}], "descriptions": [{"lang": "en", "value": "HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp", "dateUpdated": "2017-10-04T09:57:01.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "n/a"}]}, "product_name": "n/a"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409", "name": "HPSBPV02918", "refsource": "HP"}, {"url": "https://www.exploit-db.com/exploits/28713/", "name": "28713", "refsource": "EXPLOIT-DB"}, {"url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409", "name": "SSRT101127", "refsource": "HP"}, {"url": "http://zerodayinitiative.com/advisories/ZDI-13-229/", "name": "http://zerodayinitiative.com/advisories/ZDI-13-229/", "refsource": "MISC"}, {"url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2", "name": "HPSBGN03323", "refsource": "HP"}, {"url": "http://www.securitytracker.com/id/1029010", "name": "1029010", "refsource": "SECTRACK"}, {"url": "http://marc.info/?l=bugtraq&m=138696448823753&w=2", "name": "HPSBGN02952", "refsource": "HP"}, {"url": "http://secunia.com/advisories/54788", "name": "54788", "refsource": "SECUNIA"}, {"url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2", "name": "SSRT102036", "refsource": "HP"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-4810", "STATE": "PUBLIC", "ASSIGNER": "hp-security-alert@hp.com"}}}}, "cveMetadata": {"cveId": "CVE-2013-4810", "state": "PUBLISHED", "dateUpdated": "2025-10-22T00:05:40.935Z", "dateReserved": "2013-07-12T00:00:00.000Z", "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "datePublished": "2013-09-13T18:00:00.000Z", "assignerShortName": "hp"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "hp-security-alert@hp.com"}], "cisaActionDue": "2022-04-15", "cisaExploitAdd": "2022-03-25", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "HP Multiple Products Remote Code Execution Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hp:application_lifecycle_management:-:*:*:*:*:*:*:*", "matchCriteriaId": "E5B01474-2B07-4448-8265-6F3189697B5E", "vulnerable": true}, {"criteria": "cpe:2.3:a:hp:procurve_manager:3.20:*:*:*:-:*:*:*", "matchCriteriaId": "9A2CD0AC-7ED5-4C0C-8E2C-2A4531AC8A8E", "vulnerable": true}, {"criteria": "cpe:2.3:a:hp:procurve_manager:3.20:*:*:*:plus:*:*:*", "matchCriteriaId": "FEC5FF99-76CE-4525-B6B5-039762AC9425", "vulnerable": true}, {"criteria": "cpe:2.3:a:hp:procurve_manager:4.0:*:*:*:-:*:*:*", "matchCriteriaId": "D39541A2-B3DF-4A56-84C8-00FC1CB2CEA9", "vulnerable": true}, {"criteria": "cpe:2.3:a:hp:procurve_manager:4.0:*:*:*:plus:*:*:*", "matchCriteriaId": "374C81F8-DCA4-4C66-A300-94785F228E06", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874."}, {"lang": "es", "value": "HP ProCurve Manager (PCM) 3.20 y 4.0, PCM+ 3.20 y 4.0, Identity Driven Manager (IDM) 4.0 y Application Lifecycle Managemen permiten a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de un objeto marshalizado a (1) EJBInvokerServlet o (2) JMXInvokerServlet, tambi\u00e9n conocido como ZDI-CAN-1760. NOTA: esto es probablemente un duplicado de CVE-2007-1036, CVE-2010-0738 y/o CVE-2012-0874."}], "id": "CVE-2013-4810", "lastModified": "2026-06-16T23:57:56.050", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2013-4810", "options": [{"exploitation": "active"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-02-07T13:46:26.369798Z", "version": "2.0.3"}}]}, "published": "2013-09-16T13:01:46.207", "references": [{"source": "hp-security-alert@hp.com", "tags": ["Broken Link", "Vendor Advisory"], "url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409"}, {"source": "hp-security-alert@hp.com", "tags": ["Mailing List"], "url": "http://marc.info/?l=bugtraq&m=138696448823753&w=2"}, {"source": "hp-security-alert@hp.com", "tags": ["Mailing List"], "url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2"}, {"source": "hp-security-alert@hp.com", "tags": ["Broken Link", "Vendor Advisory"], "url": "http://secunia.com/advisories/54788"}, {"source": "hp-security-alert@hp.com", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1029010"}, {"source": "hp-security-alert@hp.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://zerodayinitiative.com/advisories/ZDI-13-229/"}, {"source": "hp-security-alert@hp.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/28713/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Vendor Advisory"], "url": "http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://marc.info/?l=bugtraq&m=138696448823753&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://marc.info/?l=bugtraq&m=143039425503668&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Vendor Advisory"], "url": "http://secunia.com/advisories/54788"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1029010"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://zerodayinitiative.com/advisories/ZDI-13-229/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/28713/"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["US Government Resource"], "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-4810"}], "sourceIdentifier": "hp-security-alert@hp.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "(PCM): invoker servlets do not require authentication", "id": "1031829", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1031829"}, "csaw": false, "cvss": {"cvss_base_score": "10.0", "cvss_scoring_vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "status": "draft"}, "details": ["HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874."], "name": "CVE-2013-4810", "package_state": [{"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:1", "fix_state": "Not affected", "package_name": "unknown", "product_name": "Red Hat JBoss Enterprise Web Server 1"}], "public_date": "2013-09-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2013-4810\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-4810\nhttps://access.redhat.com/site/articles/545183\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog"], "statement": "CVE-2013-4810 refers to the exposure of unauthenticated JMXInvokerServlet and EJBInvokerServlet interfaces on HP ProCurve Manager (PCM). These servlets are also, however, exposed without authentication on older, unsupported community releases of JBoss AS (WildFly) 4.x and 5.x.\nAll supported Red Hat JBoss products that include the JMXInvokerServlet and EJBInvokerServlet interfaces apply authentication by default and are not affected by this issue. \nCommunity releases of JBoss AS (WildFly) 7.x are also not affected by this issue.\nUsers of older, unsupported community releases of JBoss AS (WildFly) are advised to follow the instructions available here to apply authentication to the invoker servlet interfaces:\nhttps://community.jboss.org/wiki/SecureJboss/\nNote: Red Hat has been aware of this issue since 2012, as identified in CVE-2012-0874, and addressed the issue for supported Red Hat JBoss products based on JBoss AS 4.x and 5.x.", "threat_severity": "Critical"}

{}