CVE-2009-4188

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• HP Operations Dashboard 2.1 - Portal Default Manager Account Remote Security2009-09-03 · remote · multiple · Verified
• Apache Tomcat Manager - Application Deployer (Authenticated) Code Execution (Metasploit)2010-12-14 · remote · multiple · Verified

Impact

HP Operations Dashboard has a default password of j2deployer for the j2deployer account, which allows remote attackers to execute arbitrary code via a session that uses the manager role to conduct unrestricted file upload attacks against the /manager servlet in the Tomcat servlet container. NOTE: this might overlap CVE-2009-3098.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://www.intevydis.com/blog/?p=87
• http://www.securityfocus.com/bid/36258
• http://www.intevydis.com/blog/?p=87
• http://www.securityfocus.com/bid/36258