CVE-2009-3843
HP Operations Manager - Access Control
Title source: ruleDescription
HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers to conduct unrestricted file upload attacks, and thereby execute arbitrary code, by using the org.apache.catalina.manager.HTMLManagerServlet class to make requests to manager/html/upload.
Exploits (3)
metasploit
WORKING POC
EXCELLENT
rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_upload.rb
metasploit
WORKING POC
EXCELLENT
by jduck · rubypocjava
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/tomcat_mgr_deploy.rb
References (6)
Scores
EPSS
0.8683
EPSS Percentile
99.4%
Details
CWE
CWE-264
Status
published
Products (1)
hp/operations_manager
8.10
Published
Nov 24, 2009
Tracked Since
Feb 18, 2026