HackerFeeds
All CVEs

CVE-2013-4810

CRITICAL9.8
CISA KEV

Published 2013-09-16 · Updated 2026-06-16 · Source hp-security-alert@hp.com

Summary

CVE-2013-4810 is a critical-severity (CVSS 9.8) vulnerability in Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management. CISA added it to the Known Exploited Vulnerabilities catalog on March 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 15, 2022. CISA does not currently list it as used in ransomware campaigns. Hewlett Packard (HP) has 2 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 2 known-exploited Hewlett Packard (HP) vulnerabilities →

Description

HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-94CWE-94

CISA Known-Exploited Vulnerability

Product: Hewlett Packard (HP) — ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management

Name: HP Multiple Products Remote Code Execution Vulnerability

Date added: 2022-03-25 · Due: 2022-04-15

Required action: Apply updates per vendor instructions.

References

View on NVD