Unscored severity · published Sep 16, 2013
CVE-2013-4809
Multiple SQL injection vulnerabilities in GetEventsServlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 allow remote…
–
CVSS
3.3%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in GetEventsServlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ID
Identity Driven Manager · HP
4.0 · source: NVD
PM
Procurve Manager · HP
3.20; 4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4809
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4809
Vendor Advisory
http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?docId=emr_na-c03897409
secunia.com
http://secunia.com/advisories/54788
www.securitytracker.com
http://www.securitytracker.com/id/1029010
zerodayinitiative.com
http://zerodayinitiative.com/advisories/ZDI-13-227/
More from Identity Driven Manager
–
CVE-2013-4813
The Agent (aka AgentController) servlet in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 allows remote attackers to execute…
–
CVE-2013-4811
UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly…
–
CVE-2013-4812
UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly…