CVE-2013-4811

EUVD-2013-4656
UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Affected Products (NVD)
VendorProductVersion
hpidentity_driven_manager
4.0
hpprocurve_manager
3.20
hpprocurve_manager
4.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409
http://secunia.com/advisories/54788
http://www.securitytracker.com/id/1029010
http://zerodayinitiative.com/advisories/ZDI-13-226/
http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409
http://secunia.com/advisories/54788
http://www.securitytracker.com/id/1029010
http://zerodayinitiative.com/advisories/ZDI-13-226/