CVE-2009-4188

high · 10

HP Operations Dashboard has a default password of j2deployer for the j2deployer account, which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct unrestricted file upload attacks against the /manager servlet in the Tomcat servlet container. NOTE: this might overlap CVE-2009-3098.

CVSS

69.5%

EPSS (exploit prob.)

99th

EPSS percentile

2009-12-03

Published

AV:N/AC:L/Au:N/C:C/I:C/A:C

Weaknesses

CWE-255

Affected products

Vendor	Product	Affected versions
hp	operations_dashboard	all versions

Check a specific version with /api/v1/cve/match.

References

http://www.intevydis.com/blog/?p=87
http://www.securityfocus.com/bid/36258
http://www.intevydis.com/blog/?p=87
http://www.securityfocus.com/bid/36258

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2009-4188