Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

HP BSM 9.12 lets attackers run code via uploaded files

CVE-2012-2561 · published 14 years ago
Summary

The HP Business Service Management version 9.12 allows anyone on the network to upload a web‑application package and cause the built‑in JBoss server to run their own code. This can give an attacker control over the server and the data it handles. Apply the vendor’s update or configuration changes that block file uploads and restrict access to the affected ports (1098, 1099, 4444) as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hp business_service_management 9.12
cpe:2.3:a:hp:business_service_management:9.12:*:*:*:*:*:*:*
Original advisory text
HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server com...
HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which allows remote attackers to execute arbitrary JSP code within the JBOSS Application Server component via a crafted request to TCP port 1098, 1099, or 4444.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
9% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published21 May 2012
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2012-2561 · NVD
Track software like this
Free during beta