## https://sploitus.com/exploit?id=SAINT:4BDB0C04399C07F747315E473030C0B0
Added: 02/22/2011
CVE: [CVE-2010-0219](<https://vulners.com/cve/CVE-2010-0219>)
BID: [45625](<http://www.securityfocus.com/bid/45625>)
OSVDB: [70233](<http://www.osvdb.org/70233>)
### Background
[HP Universal CMDB Server 9.0](<https://h10078.www1.hp.com/cda/hpms/display/main/hpms_content.jsp?zn=bto&cp=1-11-15-25^1059_4000_100__>) is a modular management system that consists of a rich business-service-oriented data model with built-in discovery of configuration items (CIs) and configuration item dependencies, visualization and mapping of business services, and tracking of configuration changes.
### Problem
HP UCMDB deploys Axis2 with default credentials which can be used to gain unauthorized access to the web application server. By then uploading a specially crafted axis2 service, an attacker could execute arbitrary commands on the system.
### Resolution
Change the password for the admin account in the axis2.xml file, which is found in the \hp\UCMDB\UCMDBServer\deploy\axis2\WEB-INF\conf\ folder.
### References
<http://www.securityfocus.com/archive/1/515494>
### Limitations
Exploit works on HP Universal CMDB Server 9.0.
There may be a delay before the exploit succeeds.
### Platforms
Windows