CVE-2016-1985: hp operations_manager Code Injection

Vulnerability summary

CVE-2016-1985 is a critical (CVSS 10.0) Code Injection vulnerability in hp operations_manager. EPSS estimates a 6.63% chance of exploitation in the next 30 days, higher than 93.7% of scored vulnerabilities.

Timeline

1. 30-01-2016
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.