CVE-2020-7144: hp intelligent_management_center Expression Language Injection

Vulnerability summary

CVE-2020-7144 is a high (CVSS 10.0) Expression Language Injection vulnerability in hp intelligent_management_center. EPSS estimates a 6.89% chance of exploitation in the next 30 days, higher than 94% of scored vulnerabilities.

Timeline

1. 19-10-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A comparefilesresult expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).

• CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.