CVE-2011-0271
The CGI scripts in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 do not properly validate an unspecified parameter, which allows remote attackers to execute arbitrary commands by using a command string for this parameter's value, related to a…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The CGI scripts in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 do not properly validate an unspecified parameter, which allows remote attackers to execute arbitrary commands by using a command string for this parameter's value, related to a "command injection vulnerability."
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 7.33% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- hp/openview network node manager
- Source
- hp-security-alert@hp.com
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=887
- http://www.securityfocus.com/archive/1/515628
- http://www.securityfocus.com/bid/45762
- http://www.securitytracker.com/id?1024951
- http://www.vupen.com/english/advisories/2011/0085
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64657
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=887
- http://www.securityfocus.com/archive/1/515628
- http://www.securityfocus.com/bid/45762
- http://www.securitytracker.com/id?1024951
- http://www.vupen.com/english/advisories/2011/0085
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64657
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.