CVE-2013-4810: HP Multiple Products Remote Code Execution Vulnerability
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.
Other sources
HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or remove the EJBInvokerServlet and JMXInvokerServlet endpoints in the affected products to prevent processing of untrusted marshalled objects that can lead to remote code execution.
HP ProCurve Manager / PCM+ / Identity Driven Manager / Application Lifecycle Management EJBInvokerServlet and JMXInvokerServlet enabled = disabled - Compensating control
Restrict access to the EJBInvokerServlet and JMXInvokerServlet endpoints to trusted management networks or IP ranges (for example via firewall, ACLs, or VPN) to prevent remote attackers from reaching these servlets.
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4810?
CVE-2013-4810 is classified as a critical vulnerability that allows remote code execution.
How do I fix CVE-2013-4810?
To remediate CVE-2013-4810, users should apply the latest patches released by HP for affected versions of the software.
What software is affected by CVE-2013-4810?
CVE-2013-4810 impacts HP ProCurve Manager versions 3.20 and 4.0, Identity Driven Manager version 4.0, and Application Lifecycle Management.
Can CVE-2013-4810 be exploited remotely?
Yes, CVE-2013-4810 can be exploited remotely by attackers through specific servlets.
What types of attacks can be performed using CVE-2013-4810?
CVE-2013-4810 allows attackers to execute arbitrary code on the affected systems, leading to potential takeover.