CVE-2009-4189

high · 10

HP Operations Manager has a default password of OvW*busr1 for the ovwebusr account, which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct unrestricted file upload attacks against the /manager servlet in the Tomcat servlet container. NOTE: this might overlap CVE-2009-3099 and CVE-2009-3843.

CVSS

78.5%

EPSS (exploit prob.)

100th

EPSS percentile

2009-12-03

Published

AV:N/AC:L/Au:N/C:C/I:C/A:C

Weaknesses

CWE-255

Affected products

Vendor	Product	Affected versions
hp	operations_manager	all versions

Check a specific version with /api/v1/cve/match.

References

http://www.intevydis.com/blog/?p=87
http://www.intevydis.com/blog/?p=87

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2009-4189