CVE-2009-4189

HP Operations Manager has a default password of OvW*busr1 for the ovwebusr account, which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct unrestricted file upload attacks against the /manager servlet in the Tomcat servlet container. NOTE: this might overlap CVE-2009-3099 and CVE-2009-3843.

Score

CVSS 2.0 10.0 Critical

Status

Modified - cve@mitre.org

Published

2009-12-03

Last modified

2024-09-16

Weaknesses

CWE-255

Affected products

• Operations Manager (Hp)

References

• http://www.intevydis.com/blog/?p=87