CVE-2016-2000: Critical severity hp asset manager vulnerability

Published Apr 5, 2016

Updated

HPE Asset Manager 9.40, 9.41, and 9.50 and Asset Manager CloudSystem Chargeback 9.40 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected Software

4 affected components

HP Asset Manager=9.40

HP Asset Manager=9.41

HP Asset Manager=9.50

HP Asset Manager Cloudsystem Chargeback=9.40

Remediation

Patch Available

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05064889

Event History

Apr 5, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-2000?

CVE-2016-2000 is classified as a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2016-2000?

To fix CVE-2016-2000, upgrade to the latest version of HPE Asset Manager or the Asset Manager CloudSystem Chargeback that contains patches addressing this vulnerability.

Which versions are affected by CVE-2016-2000?

CVE-2016-2000 affects HPE Asset Manager versions 9.40, 9.41, 9.50, and Asset Manager CloudSystem Chargeback version 9.40.

Can CVE-2016-2000 be exploited remotely?

Yes, CVE-2016-2000 can be exploited remotely by attackers through a crafted serialized Java object.

What is the impact of CVE-2016-2000 on my system?

The impact of CVE-2016-2000 includes the potential for unauthorized remote command execution, which can compromise system integrity.