CVE-2009-4189 — HIGH (10.0)

Vulnerability Description

HP Operations Manager has a default password of OvW*busr1 for the ovwebusr account, which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct unrestricted file upload attacks against the /manager servlet in the Tomcat servlet container. NOTE: this might overlap CVE-2009-3099 and CVE-2009-3843.

CVSS Score

10.0

HIGH

AV:N/AC:L/Au:N/C:C/I:C/A:C

Confidentiality

COMPLETE

Integrity

COMPLETE

Availability

COMPLETE

Affected Products

Vendor	Product	Versions
Hp	Operations Manager	All versions

Related Weaknesses (CWE)

CWE-255

References

FAQ

What is CVE-2009-4189?

CVE-2009-4189 is a vulnerability with a CVSS score of 10.0 (HIGH). HP Operations Manager has a default password of OvW*busr1 for the ovwebusr account, which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct unrestri...

How severe is CVE-2009-4189?

CVE-2009-4189 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2009-4189?

Check the references section above for vendor advisories and patch information. Affected products include: Hp Operations Manager.