Live › vulnerability › CVE-2013-4810
Go to dashboardHP ProCurve Manager (PCM/PCM+) 3.20 and 4.0 and Identity Driven Manager 4.0 expose unauthenticated EJBInvokerServlet and JMXInvokerServlet (JBoss invoker servlets). A remote attacker sends a serialized Java object and runs code as the PCM server user. It is in CISA KEV and a public exploit exists. HP fixed it in 2013 through PCM AutoUpdate.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management | vendor | – | – |
| HP ProCurve Manager (PCM) / PCM+ | vendor | 3.20, 4.0 | 4.00 AutoUpdate #6 04.00.06.628 |
| HP Identity Driven Manager (IDM) | vendor | 4.0 | PCM 4.00 AutoUpdate #6 04.00.06.628 |
04.00.06.628 (AutoUpdate #6) or later04.00.06.628), which covers IDM v4.00 and PCM v4.00 for CVE-2013-4810Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.
This page as .md · .json · in your agent: get_signal("CVE-2013-4810")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.