VAR-201604-0579
Vulnerability from variot - Updated: 2025-04-13 23:36HPE P9000 Command View Advanced Edition Software (CVAE) 7.x and 8.x before 8.4.0-00 and XP7 CVAE 7.x and 8.x before 8.4.0-00 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. Supplementary information : CWE Vulnerability type by CWE-502: Deserialization of Untrusted Data ( Deserialization of unreliable data ) Has been identified. http://cwe.mitre.org/data/definitions/502.htmlSkillfully crafted serialized by a third party Java An arbitrary command may be executed through the object. HPXPP9000CommandViewAdvancedEdition is a multi-function device manager for HPXPP9500 and XPDiskArray products. HPEP9000CommandViewAdvancedEditionSoftware (CVAE) and XP7CVAE have security vulnerabilities. Multiple HP products are prone to remote code execution vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. The following products are vulnerable: HP XP7 Command View Advanced Edition Suite 7.0.0-02 through versions prior to 8.4.0-00 HP P9000 Command View Advanced Edition Software 7.0.0-02 through versions prior to 8.4.0-00. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c05085438
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c05085438 Version: 2
HPSBST03576 rev.2 - HP P9000, XP7 Command View Advanced Edition (CVAE) Suite including Device Manager and Tiered Storage Manager using Java Deserialization, Remote Arbitrary Code Execution
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.
Release Date: 2016-04-15 Last Updated: 2016-04-15
Potential Security Impact: Remote Arbitrary Code Execution
Source: Hewlett Packard Enterprise, Product Security Response Team
VULNERABILITY SUMMARY A vulnerability in Apache Commons Collections (ACC) for handling Java object deserialization was addressed by HP P9000 and HP XP7 Command View Advanced Edition (CVAE) Suite including Device Manager and Tiered Storage Manager.
References:
CVE-2016-2003 JPCERT-VU#576313 PSRT110077
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. Customers unable to apply the updates should please contact HPE Technical Support to discuss options.
HISTORY Version:1 (rev.1) - 15 April 2016 Initial release Version:2 (rev.2) - 15 April 2016 Text alignment for impacted product name
Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com.
Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com
Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice
Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive
Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB.
3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX
Copyright 2016 Hewlett Packard Enterprise
Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQEcBAEBAgAGBQJXFQp4AAoJEGIGBBYqRO9/DIEIAIrEUwoavbvJ0LXL7DevhcMm UcKW7ACUONQnk70xxAxDXDoIdSuoSiv5bCkLh4KpMA8gm5OvtRMR8NHj/h/BZYa3 UbkyMGoytxsDCxWV+M+FsPVy/7fXm4lxvcfx2AJgEEbnoF5oVGagK5oTzkzbvTGd 6u8VACsK+mb4zCy8kPkqE9SzdcEd1ad2ciuNLQa4zl374TMPRpLjRBsk7VVKkkoT m40jXz+6MBL9RbbJAUo6kjQUV9m2WBksqwnwD5R3Q508h7DRMCxwcF3lKF/hLVdz h013I2TC8rpK3uTiI2KjfWbl/m4K4A8aFHIaZ1hy2NPJqVhy/ohCm+dqWKkDVlk= =U3/g -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201604-0579",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "xp7 command view advanced edition suite",
"scope": "eq",
"trust": 1.6,
"vendor": "hp",
"version": null
},
{
"model": "p9000 command view advanced edition software",
"scope": "eq",
"trust": 1.6,
"vendor": "hp",
"version": null
},
{
"model": "hpe xp7 command view advanced edition suite",
"scope": "lt",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "8.x"
},
{
"model": "hpe xp7 command view advanced edition suite",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "8.4.0-00"
},
{
"model": "hpe xp7 command view advanced edition suite",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "7.x"
},
{
"model": "hpe xp p9000 command view",
"scope": "lt",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "8.x"
},
{
"model": "hpe xp p9000 command view",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "advanced edition software 7.x"
},
{
"model": "hpe xp p9000 command view",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "advanced edition software 8.4.0-00"
},
{
"model": "p9000 command view advanced edition",
"scope": "eq",
"trust": 0.6,
"vendor": "hp",
"version": "7.0.0-02\u003c8.4.0-00"
},
{
"model": "xp7 command view advanced edition suite",
"scope": "eq",
"trust": 0.6,
"vendor": "hp",
"version": "7.0.0-02\u003c8.4.0-00"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-02521"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002435"
},
{
"db": "CNNVD",
"id": "CNNVD-201604-364"
},
{
"db": "NVD",
"id": "CVE-2016-2003"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:hp:xp_p9000_command_view",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:hp:xp7_command_view_advanced_edition_suite",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-002435"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "foxglovesecurity",
"sources": [
{
"db": "BID",
"id": "86539"
}
],
"trust": 0.3
},
"cve": "CVE-2016-2003",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2016-2003",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2016-02521",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2016-2003",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-2003",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2016-2003",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2016-02521",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201604-364",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2016-2003",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-02521"
},
{
"db": "VULMON",
"id": "CVE-2016-2003"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002435"
},
{
"db": "CNNVD",
"id": "CNNVD-201604-364"
},
{
"db": "NVD",
"id": "CVE-2016-2003"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "HPE P9000 Command View Advanced Edition Software (CVAE) 7.x and 8.x before 8.4.0-00 and XP7 CVAE 7.x and 8.x before 8.4.0-00 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library. Supplementary information : CWE Vulnerability type by CWE-502: Deserialization of Untrusted Data ( Deserialization of unreliable data ) Has been identified. http://cwe.mitre.org/data/definitions/502.htmlSkillfully crafted serialized by a third party Java An arbitrary command may be executed through the object. HPXPP9000CommandViewAdvancedEdition is a multi-function device manager for HPXPP9500 and XPDiskArray products. HPEP9000CommandViewAdvancedEditionSoftware (CVAE) and XP7CVAE have security vulnerabilities. Multiple HP products are prone to remote code execution vulnerability. \nSuccessfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. \nThe following products are vulnerable:\nHP XP7 Command View Advanced Edition Suite 7.0.0-02 through versions prior to 8.4.0-00\nHP P9000 Command View Advanced Edition Software 7.0.0-02 through versions prior to 8.4.0-00. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nNote: the current version of the following document is available here:\nhttps://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n\na-c05085438\n\nSUPPORT COMMUNICATION - SECURITY BULLETIN\n\nDocument ID: c05085438\nVersion: 2\n\nHPSBST03576 rev.2 - HP P9000, XP7 Command View Advanced Edition (CVAE) Suite\nincluding Device Manager and Tiered Storage Manager using Java\nDeserialization, Remote Arbitrary Code Execution\n\nNOTICE: The information in this Security Bulletin should be acted upon as\nsoon as possible. \n\nRelease Date: 2016-04-15\nLast Updated: 2016-04-15\n\nPotential Security Impact: Remote Arbitrary Code Execution\n\nSource: Hewlett Packard Enterprise, Product Security Response Team\n\nVULNERABILITY SUMMARY\nA vulnerability in Apache Commons Collections (ACC) for handling Java object\ndeserialization was addressed by HP P9000 and HP XP7 Command View Advanced\nEdition (CVAE) Suite including Device Manager and Tiered Storage Manager. \n\nReferences:\n\nCVE-2016-2003\nJPCERT-VU#576313\nPSRT110077\n\nSUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. Customers unable\nto apply the updates should please contact HPE Technical Support to discuss\noptions. \n\nHISTORY\nVersion:1 (rev.1) - 15 April 2016 Initial release\nVersion:2 (rev.2) - 15 April 2016 Text alignment for impacted product name\n\nThird Party Security Patches: Third party security patches that are to be\ninstalled on systems running Hewlett Packard Enterprise (HPE) software\nproducts should be applied in accordance with the customer\u0027s patch management\npolicy. \n\nSupport: For issues about implementing the recommendations of this Security\nBulletin, contact normal HPE Services support channel. For other issues about\nthe content of this Security Bulletin, send e-mail to security-alert@hpe.com. \n\nReport: To report a potential security vulnerability with any HPE supported\nproduct, send Email to: security-alert@hpe.com\n\nSubscribe: To initiate a subscription to receive future HPE Security Bulletin\nalerts via Email: http://www.hpe.com/support/Subscriber_Choice\n\nSecurity Bulletin Archive: A list of recently released Security Bulletins is\navailable here: http://www.hpe.com/support/Security_Bulletin_Archive\n\nSoftware Product Category: The Software Product Category is represented in\nthe title by the two characters following HPSB. \n\n3C = 3COM\n3P = 3rd Party Software\nGN = HPE General Software\nHF = HPE Hardware and Firmware\nMU = Multi-Platform Software\nNS = NonStop Servers\nOV = OpenVMS\nPV = ProCurve\nST = Storage Software\nUX = HP-UX\n\nCopyright 2016 Hewlett Packard Enterprise\n\nHewlett Packard Enterprise shall not be liable for technical or editorial\nerrors or omissions contained herein. The information provided is provided\n\"as is\" without warranty of any kind. To the extent permitted by law, neither\nHP or its affiliates, subcontractors or suppliers will be liable for\nincidental,special or consequential damages including downtime cost; lost\nprofits; damages relating to the procurement of substitute products or\nservices; or damages for loss of data, or software restoration. The\ninformation in this document is subject to change without notice. Hewlett\nPackard Enterprise and the names of Hewlett Packard Enterprise products\nreferenced herein are trademarks of Hewlett Packard Enterprise in the United\nStates and other countries. Other product and company names mentioned herein\nmay be trademarks of their respective owners. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQEcBAEBAgAGBQJXFQp4AAoJEGIGBBYqRO9/DIEIAIrEUwoavbvJ0LXL7DevhcMm\nUcKW7ACUONQnk70xxAxDXDoIdSuoSiv5bCkLh4KpMA8gm5OvtRMR8NHj/h/BZYa3\nUbkyMGoytxsDCxWV+M+FsPVy/7fXm4lxvcfx2AJgEEbnoF5oVGagK5oTzkzbvTGd\n6u8VACsK+mb4zCy8kPkqE9SzdcEd1ad2ciuNLQa4zl374TMPRpLjRBsk7VVKkkoT\nm40jXz+6MBL9RbbJAUo6kjQUV9m2WBksqwnwD5R3Q508h7DRMCxwcF3lKF/hLVdz\nh013I2TC8rpK3uTiI2KjfWbl/m4K4A8aFHIaZ1hy2NPJqVhy/ohCm+dqWKkDVlk=\n=U3/g\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-2003"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002435"
},
{
"db": "CNVD",
"id": "CNVD-2016-02521"
},
{
"db": "BID",
"id": "86539"
},
{
"db": "VULMON",
"id": "CVE-2016-2003"
},
{
"db": "PACKETSTORM",
"id": "136725"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-2003",
"trust": 3.5
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002435",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2016-02521",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2016.0985",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201604-364",
"trust": 0.6
},
{
"db": "BID",
"id": "86539",
"trust": 0.4
},
{
"db": "VULMON",
"id": "CVE-2016-2003",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "136725",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-02521"
},
{
"db": "VULMON",
"id": "CVE-2016-2003"
},
{
"db": "BID",
"id": "86539"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002435"
},
{
"db": "PACKETSTORM",
"id": "136725"
},
{
"db": "CNNVD",
"id": "CNNVD-201604-364"
},
{
"db": "NVD",
"id": "CVE-2016-2003"
}
]
},
"id": "VAR-201604-0579",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-02521"
}
],
"trust": 1.05238097
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-02521"
}
]
},
"last_update_date": "2025-04-13T23:36:24.864000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HPSBST03576",
"trust": 0.8,
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085438"
},
{
"title": "Patch for HPEP9000CVAE arbitrary command execution vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/74747"
},
{
"title": "Java-Deserialization-Cheat-Sheet",
"trust": 0.1,
"url": "https://github.com/klausware/Java-Deserialization-Cheat-Sheet "
},
{
"title": "Java-Deserialization-Cheat-Sheet",
"trust": 0.1,
"url": "https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet "
},
{
"title": "Java-Deserialization-CVEs",
"trust": 0.1,
"url": "https://github.com/PalindromeLabs/Java-Deserialization-CVEs "
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-02521"
},
{
"db": "VULMON",
"id": "CVE-2016-2003"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002435"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-002435"
},
{
"db": "NVD",
"id": "CVE-2016-2003"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05085438"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-2003"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-2003"
},
{
"trust": 0.6,
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05085438"
},
{
"trust": 0.6,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05085438"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/render.html?it=33638"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.securityfocus.com/bid/86539"
},
{
"trust": 0.1,
"url": "https://github.com/klausware/java-deserialization-cheat-sheet"
},
{
"trust": 0.1,
"url": "https://github.com/grrrdog/java-deserialization-cheat-sheet"
},
{
"trust": 0.1,
"url": "https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_n"
},
{
"trust": 0.1,
"url": "http://www.hpe.com/support/subscriber_choice"
},
{
"trust": 0.1,
"url": "http://www.hpe.com/support/security_bulletin_archive"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-2003"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-02521"
},
{
"db": "VULMON",
"id": "CVE-2016-2003"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002435"
},
{
"db": "PACKETSTORM",
"id": "136725"
},
{
"db": "CNNVD",
"id": "CNNVD-201604-364"
},
{
"db": "NVD",
"id": "CVE-2016-2003"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2016-02521"
},
{
"db": "VULMON",
"id": "CVE-2016-2003"
},
{
"db": "BID",
"id": "86539"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-002435"
},
{
"db": "PACKETSTORM",
"id": "136725"
},
{
"db": "CNNVD",
"id": "CNNVD-201604-364"
},
{
"db": "NVD",
"id": "CVE-2016-2003"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-04-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-02521"
},
{
"date": "2016-04-20T00:00:00",
"db": "VULMON",
"id": "CVE-2016-2003"
},
{
"date": "2016-04-15T00:00:00",
"db": "BID",
"id": "86539"
},
{
"date": "2016-05-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-002435"
},
{
"date": "2016-04-19T22:53:05",
"db": "PACKETSTORM",
"id": "136725"
},
{
"date": "2016-04-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201604-364"
},
{
"date": "2016-04-20T17:59:02.900000",
"db": "NVD",
"id": "CVE-2016-2003"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-04-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-02521"
},
{
"date": "2016-12-01T00:00:00",
"db": "VULMON",
"id": "CVE-2016-2003"
},
{
"date": "2016-04-15T00:00:00",
"db": "BID",
"id": "86539"
},
{
"date": "2016-05-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-002435"
},
{
"date": "2016-04-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201604-364"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2016-2003"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "136725"
},
{
"db": "CNNVD",
"id": "CNNVD-201604-364"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "HPE P9000 CVAE Software and XP7 CVAE Vulnerable to arbitrary command execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-002435"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201604-364"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…