Description
The helpmanager servlet in the web server in HP OpenView Performance Insight (OVPI) 5.4 and earlier does not properly authenticate and validate requests, which allows remote attackers to execute arbitrary commands via vectors involving upload of a JSP document.
References
- 20100309 ZDI-10-026: Hewlett-Packard OVPI helpmanager Servlet Remote Code Execution Vulnerability mailing-list
- 38899 third-party-advisory
- 38611 vdb-entry
- hp-performance-unspec-command-exec(56757) vdb-entry
- http://www.zerodayinitiative.com/advisories/ZDI-10-026
- 62797 vdb-entry
- HPSBMA02489 vendor-advisory
- ADV-2010-0555 vdb-entry