CVE-2009-3843 | BDVDB-2026-39356 Detail

Description#

HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://marc.info/?l=bugtraq&m=125873415424980&w=2
http://www.zerodayinitiative.com/advisories/ZDI-09-085/
https://exchange.xforce.ibmcloud.com/vulnerabilities/54361
http://securitytracker.com/id?1023222
http://secunia.com/advisories/37444
http://www.osvdb.org/60317

Exploit#

No public exploit known

History#

Version 12009-11-24Record published in the CVE List.
Version 22024-08-07Most recent update recorded in the CVE List.