{"api_version":"1","generated_at":"2026-07-23T11:08:42+00:00","cve":"CVE-2010-0447","urls":{"html":"https://cve.report/CVE-2010-0447","api":"https://cve.report/api/cve/CVE-2010-0447.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2010-0447","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2010-0447"},"summary":{"title":"CVE-2010-0447","description":"The helpmanager servlet in the web server in HP OpenView Performance Insight (OVPI) 5.4 and earlier does not properly authenticate and validate requests, which allows remote attackers to execute arbitrary commands via vectors involving upload of a JSP document.","state":"PUBLISHED","assigner":"hp","published_at":"2010-03-10 22:30:01","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-287","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"10","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://marc.info/?l=bugtraq&m=126815897824020&w=2","name":"http://marc.info/?l=bugtraq&m=126815897824020&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'[security bulletin] HPSBMA02489 SSRT090065 rev.1 - HP Performance Insight , Remote Execution of Arbi' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56757","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56757","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/38899","name":"http://secunia.com/advisories/38899","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"HP Performance Insight Arbitrary Command Execution Vulnerability - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-10-026","name":"http://www.zerodayinitiative.com/advisories/ZDI-10-026","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Zero Day Initiative","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2010/0555","name":"http://www.vupen.com/english/advisories/2010/0555","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/38611","name":"http://www.securityfocus.com/bid/38611","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"HP Performance Insight Remote Command Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securityfocus.com/archive/1/509984/100/0/threaded","name":"http://www.securityfocus.com/archive/1/509984/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/62797","name":"http://osvdb.org/62797","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-0447","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-0447","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2010","cve_id":"447","vulnerable":"1","versionEndIncluding":"5.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hp","cpe5":"openview_performance_insight","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T00:52:17.350Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20100309 ZDI-10-026: Hewlett-Packard OVPI helpmanager Servlet Remote Code Execution Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/509984/100/0/threaded"},{"name":"38899","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/38899"},{"name":"38611","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/38611"},{"name":"hp-performance-unspec-command-exec(56757)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56757"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-10-026"},{"name":"62797","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/62797"},{"name":"HPSBMA02489","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=126815897824020&w=2"},{"name":"SSRT090065","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=126815897824020&w=2"},{"name":"ADV-2010-0555","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2010/0555"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2010-03-08T00:00:00.000Z","descriptions":[{"lang":"en","value":"The helpmanager servlet in the web server in HP OpenView Performance Insight (OVPI) 5.4 and earlier does not properly authenticate and validate requests, which allows remote attackers to execute arbitrary commands via vectors involving upload of a JSP document."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-10T18:57:01.000Z","orgId":"74586083-13ce-40fd-b46a-8e5d23cfbcb2","shortName":"hp"},"references":[{"name":"20100309 ZDI-10-026: Hewlett-Packard OVPI helpmanager Servlet Remote Code Execution Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/509984/100/0/threaded"},{"name":"38899","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/38899"},{"name":"38611","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/38611"},{"name":"hp-performance-unspec-command-exec(56757)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56757"},{"tags":["x_refsource_MISC"],"url":"http://www.zerodayinitiative.com/advisories/ZDI-10-026"},{"name":"62797","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/62797"},{"name":"HPSBMA02489","tags":["vendor-advisory","x_refsource_HP"],"url":"http://marc.info/?l=bugtraq&m=126815897824020&w=2"},{"name":"SSRT090065","tags":["vendor-advisory","x_refsource_HP"],"url":"http://marc.info/?l=bugtraq&m=126815897824020&w=2"},{"name":"ADV-2010-0555","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2010/0555"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"hp-security-alert@hp.com","ID":"CVE-2010-0447","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The helpmanager servlet in the web server in HP OpenView Performance Insight (OVPI) 5.4 and earlier does not properly authenticate and validate requests, which allows remote attackers to execute arbitrary commands via vectors involving upload of a JSP document."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20100309 ZDI-10-026: Hewlett-Packard OVPI helpmanager Servlet Remote Code Execution Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/509984/100/0/threaded"},{"name":"38899","refsource":"SECUNIA","url":"http://secunia.com/advisories/38899"},{"name":"38611","refsource":"BID","url":"http://www.securityfocus.com/bid/38611"},{"name":"hp-performance-unspec-command-exec(56757)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/56757"},{"name":"http://www.zerodayinitiative.com/advisories/ZDI-10-026","refsource":"MISC","url":"http://www.zerodayinitiative.com/advisories/ZDI-10-026"},{"name":"62797","refsource":"OSVDB","url":"http://osvdb.org/62797"},{"name":"HPSBMA02489","refsource":"HP","url":"http://marc.info/?l=bugtraq&m=126815897824020&w=2"},{"name":"SSRT090065","refsource":"HP","url":"http://marc.info/?l=bugtraq&m=126815897824020&w=2"},{"name":"ADV-2010-0555","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2010/0555"}]}}}},"cveMetadata":{"assignerOrgId":"74586083-13ce-40fd-b46a-8e5d23cfbcb2","assignerShortName":"hp","cveId":"CVE-2010-0447","datePublished":"2010-03-10T22:00:00.000Z","dateReserved":"2010-01-27T00:00:00.000Z","dateUpdated":"2024-08-07T00:52:17.350Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2010-03-10 22:30:01","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-287","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:hp:openview_performance_insight:*:*:*:*:*:*:*:*","versionEndIncluding":"5.4","matchCriteriaId":"6F69D12F-E59E-4632-A0EB-062907AD0802"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2010","CveId":"447","Ordinal":"1","Title":"CVE-2010-0447","CVE":"CVE-2010-0447","Year":"2010"},"notes":[{"CveYear":"2010","CveId":"447","Ordinal":"1","NoteData":"The helpmanager servlet in the web server in HP OpenView Performance Insight (OVPI) 5.4 and earlier does not properly authenticate and validate requests, which allows remote attackers to execute arbitrary commands via vectors involving upload of a JSP document.","Type":"Description","Title":"CVE-2010-0447"},{"CveYear":"2010","CveId":"447","Ordinal":"2","NoteData":"2010-03-10","Type":"Other","Title":"Published"},{"CveYear":"2010","CveId":"447","Ordinal":"3","NoteData":"2018-10-10","Type":"Other","Title":"Modified"}]}}}