{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2010-03-08T00:00:00", "descriptions": [{"lang": "en", "value": "The helpmanager servlet in the web server in HP OpenView Performance Insight (OVPI) 5.4 and earlier does not properly authenticate and validate requests, which allows remote attackers to execute arbitrary commands via vectors involving upload of a JSP document."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-10T18:57:01", "orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp"}, "references": [{"name": "20100309 ZDI-10-026: Hewlett-Packard OVPI helpmanager Servlet Remote Code Execution Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/509984/100/0/threaded"}, {"name": "38899", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/38899"}, {"name": "38611", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/38611"}, {"name": "hp-performance-unspec-command-exec(56757)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56757"}, {"tags": ["x_refsource_MISC"], "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-026"}, {"name": "62797", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/62797"}, {"name": "HPSBMA02489", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=126815897824020&w=2"}, {"name": "SSRT090065", "tags": ["vendor-advisory", "x_refsource_HP"], "url": "http://marc.info/?l=bugtraq&m=126815897824020&w=2"}, {"name": "ADV-2010-0555", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2010/0555"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "hp-security-alert@hp.com", "ID": "CVE-2010-0447", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The helpmanager servlet in the web server in HP OpenView Performance Insight (OVPI) 5.4 and earlier does not properly authenticate and validate requests, which allows remote attackers to execute arbitrary commands via vectors involving upload of a JSP document."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20100309 ZDI-10-026: Hewlett-Packard OVPI helpmanager Servlet Remote Code Execution Vulnerability", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/509984/100/0/threaded"}, {"name": "38899", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/38899"}, {"name": "38611", "refsource": "BID", "url": "http://www.securityfocus.com/bid/38611"}, {"name": "hp-performance-unspec-command-exec(56757)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56757"}, {"name": "http://www.zerodayinitiative.com/advisories/ZDI-10-026", "refsource": "MISC", "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-026"}, {"name": "62797", "refsource": "OSVDB", "url": "http://osvdb.org/62797"}, {"name": "HPSBMA02489", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=126815897824020&w=2"}, {"name": "SSRT090065", "refsource": "HP", "url": "http://marc.info/?l=bugtraq&m=126815897824020&w=2"}, {"name": "ADV-2010-0555", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2010/0555"}]}}}}, "cveMetadata": {"assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "assignerShortName": "hp", "cveId": "CVE-2010-0447", "datePublished": "2010-03-10T22:00:00", "dateReserved": "2010-01-27T00:00:00", "dateUpdated": "2018-10-10T18:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hp:openview_performance_insight:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F69D12F-E59E-4632-A0EB-062907AD0802", "versionEndIncluding": "5.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The helpmanager servlet in the web server in HP OpenView Performance Insight (OVPI) 5.4 and earlier does not properly authenticate and validate requests, which allows remote attackers to execute arbitrary commands via vectors involving upload of a JSP document."}, {"lang": "es", "value": "El helpmanager servlet en el servidor web en HP OpenView Performance Insight (OVPI) v5.4 y anteriores no autentifica, ni valida correctamente las peticiones, lo que permite a atacantes ejecutar comandos arbitrarios a trav\u00e9s de vectores involucrados en la carga de documentos JSP. \r\n"}], "id": "CVE-2010-0447", "lastModified": "2018-10-10T19:52:52.367", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2010-03-10T22:30:01.277", "references": [{"source": "hp-security-alert@hp.com", "url": "http://marc.info/?l=bugtraq&m=126815897824020&w=2"}, {"source": "hp-security-alert@hp.com", "url": "http://osvdb.org/62797"}, {"source": "hp-security-alert@hp.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/38899"}, {"source": "hp-security-alert@hp.com", "url": "http://www.securityfocus.com/archive/1/509984/100/0/threaded"}, {"source": "hp-security-alert@hp.com", "url": "http://www.securityfocus.com/bid/38611"}, {"source": "hp-security-alert@hp.com", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2010/0555"}, {"source": "hp-security-alert@hp.com", "url": "http://www.zerodayinitiative.com/advisories/ZDI-10-026"}, {"source": "hp-security-alert@hp.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56757"}], "sourceIdentifier": "hp-security-alert@hp.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}