HPE Performance Cluster Manager Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in the HPE Performance Cluster Manager (HPCM) GUI, version 1.12 and earlier. This vulnerability could allow an attacker to bypass authentication mechanisms within the application.

Impact

Exploitation of this vulnerability could lead to unauthorized access by bypassing authentication requirements in the HPCM GUI.

Remediation

HPE has released a patch for this vulnerability in HPCM version 1.13. For versions prior to 1.13, HPE recommends disabling the GUI by adding '-Dcmu.rmi=false' to the 'CMU_JAVA_SERVER_ARGS' in the 'cmuserver.conf' file, and restarting the 'cmdb.service'. This will prevent the RMI service, which the GUI uses to communicate with the server, from starting.