CVE-2012-2561 File upload in n/a

Critical 10.0 Published 21 May 2012 Updated 6 Aug 2024

Remote attackers can upload malicious WAR files to execute arbitrary JSP code on HP BSM servers via exposed JBOSS ports.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2012-2561?

CVE-2012-2561 is a critical vulnerability in n/a, published on 21 May 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component via a crafted request to TCP port 1098, 1099, or 4444.

Weakness: CWE-264

Which versions are affected by CVE-2012-2561?

It affects 1 product.

Products include Hp Business Service Management.

How do I fix CVE-2012-2561?

No fix has been published for CVE-2012-2561 yet. Limit exposure of the affected software until one is available.

Is CVE-2012-2561 being exploited?

There is no known exploitation of CVE-2012-2561 in the wild and no public exploit code.

Sources

Also known as GHSA-6c74-9v8c-c8ch.