{"id":"CVE-2013-4810","kind":"vulnerability","aliases":["CVE-2013-4810"],"related":[],"title":"Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management: HP Multiple Products Remote Code Execution Vulnerability","description":"HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.","summary":"HP ProCurve Manager (PCM/PCM+) 3.20 and 4.0 and Identity Driven Manager 4.0 expose unauthenticated EJBInvokerServlet and JMXInvokerServlet (JBoss invoker servlets). A remote attacker sends a serialized Java object and runs code as the PCM server user. It is in CISA KEV and a public exploit exists. HP fixed it in 2013 through PCM AutoUpdate.","severity":"critical","cvss":10.0,"epss":0.79468,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"HP ProCurve Manager (PCM) / PCM+","fixed":["4.00 AutoUpdate #6 04.00.06.628"],"affected":"3.20, 4.0","ecosystem":"vendor"},{"name":"HP Identity Driven Manager (IDM)","fixed":["PCM 4.00 AutoUpdate #6 04.00.06.628"],"affected":"4.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["deserialization","exploited","hp-alm","hp-idm","hp-pcm","hp-procurve-manager","java","self-hosted","vendor"],"not_affected_if":["not-deployed-hp-products","not-network-reachable","pcm-4.00-autoupdate-6-or-later"],"how_to_check":"In the PCM client, open Help > About (or the AutoUpdate list) and check that PCM is at 04.00.06.628 (AutoUpdate #6) or later. From the network, an HTTP request to /invoker/EJBInvokerServlet or /invoker/JMXInvokerServlet on the PCM server that returns 200 instead of 401/403 means it is exposed. Better still, do not expose the PCM server to untrusted networks.","fix":"Run PCM AutoUpdate and install PCM v4.00 AutoUpdate #6 (04.00.06.628), which covers IDM v4.00 and PCM v4.00 for CVE-2013-4810. For PCM 3.20 the bulletin lists no fix for this CVE, so move to 4.00 and update. Product is end-of-life, so restrict network access to the server and retire it where possible.","status":"open","published_at":"2013-09-16T13:01:46+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:21:54+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T21:21:54Z","model":"claude-haiku-5-5","output":{"fix":"Apply the HP vendor update for the affected product, as CISA's required action directs; the sources do not name a fixed version.","reach":"network","impact":"high","summary":"HP ProCurve Manager, PCM+, Identity Driven Manager and Application Lifecycle Management accept marshalled Java objects at the EJBInvokerServlet and JMXInvokerServlet endpoints. An remote attacker can send a crafted object and execute arbitrary code on the server.","category":"vendor","who_cares":["hp-procurve-manager","hp-pcm","hp-idm","hp-alm","java"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Remote attacker runs arbitrary code on the management server.","analyst_note":"Find the HP advisory for CVE-2013-4810 and the fixed build numbers per product; the sources give no version or check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-deployed-hp-products"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000488,"input_tokens":2969,"output_tokens":382,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the HP advisory for CVE-2013-4810 and the fixed build numbers per product; the sources give no version or check command.","search":"'-0738':182C '-0874':186C '-1036':179C '-2007':178C '-2010':181C '-2012':185C '-2013':24A,27A '-4810':25A,28A '1':160C '1760':169C '2':163C '2013':124B '3.20':78B,132C,136C '4.0':80B,85B,134C,138C,143C 'aka':165C 'allow':148C 'alm':58B 'and':40A 'and/or':183C 'applic':13A,145C 'application':41A 'arbitrari':153C 'attack':96B,150C 'autoupd':127B 'cisa':113B 'code':20A,104B,154C 'cve':23A,26A,177C,180C,184C 'deseri':54B 'driven':9A,37A,51A,83B,140C 'duplic':175C 'ejbinvokerservlet':88B,161C 'execut':21A,152C 'exist':119B 'exploit':55B,118B 'expos':86B 'fix':121B 'hewlett':1A,29A 'host':72B 'hp':3A,16A,31A,44A,49A,57B,60B,63B,66B,74B,120B,128C 'hp-alm':56B 'hp-idm':59B 'hp-pcm':62B 'hp-procurve-manag':65B 'ident':8A,82B,139C 'identity':36A,50A 'idm':11A,39A,53A,61B,142C 'invok':92B 'java':69B,100B 'jboss':91B 'jmxinvokerservlet':90B,164C 'kev':114B 'lifecycl':14A,146C 'lifecycle':42A 'manag':5A,10A,15A,68B,76B,84B,130C,141C,147C 'management':43A 'manager':33A,38A,46A,52A 'marshal':157C 'multipl':17A 'note':170C 'object':101B,158C 'packard':2A,30A 'pcm':6A,7A,34A,35A,47A,48A,64B,107B,126B,131C,135C 'pcm/pcm':77B 'probabl':173C 'procurv':4A,67B,75B,129C 'procurve':32A,45A 'product':18A 'public':117B 'remot':19A,95B,149C 'run':103B 'self':71B 'self-host':70B 'send':97B 'serial':99B 'server':108B 'servlet':93B 'unauthent':87B 'user':109B 'vendor':73B 'via':155C 'vulner':22A 'zdi':167C 'zdi-can':166C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2013-09-16T13:01:46+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2013-4810","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-4810","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2013-4810","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-4810","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2013-4810:64","url":null,"severity":null,"published_at":"2026-10-23T21:22:45+00:00","modified_at":"2026-10-23T21:22:45+00:00","first_seen_at":"2026-10-23T21:22:45+00:00","fetched_at":"2026-10-23T21:22:45+00:00","note":"Read HP bulletin HPSBPV02918 (c03897409, 2013-09-09) via bugtraq copy: CVE-2013-4810 (SSRT101127, ZDI-CAN-1760) fixed by PCM v4.00 AutoUpdate #6 04.00.06.628. Bulletin does not list Application Lifecycle Management nor a 3.20 fix for this CVE (3.20 AutoUpdate #8 C.03.20.1741 is listed only for CVE-2013-4813): unknown. PoC: Exploit-DB 28713 (from CVE refs, page not read). Red Hat says same servlets are open in unsupported JBoss AS 4.x/5.x."},{"source":"nvd","external_id":"CVE-2013-4810","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4810","severity":null,"published_at":"2013-09-16T13:01:46+00:00","modified_at":"2026-06-16T23:57:56+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":964,"url":"https://lists.openwall.net/bugtraq/2013/09/10/15","title":"HPSBPV02918 rev.1 - HP PCM, PCM+ and IDM (bugtraq copy of HP bulletin c03897409)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":965,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1031829","title":"Red Hat Bugzilla 1031829: CVE-2013-4810 invoker servlets unauthenticated","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":966,"url":"https://www.exploit-db.com/exploits/28713","title":"Exploit-DB 28713 (listed in CVE references for CVE-2013-4810)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}