CVE-2011-3846: Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) 6.2.2.7 allows remot...

Security readout for executives and security teams

This issue lets an attacker abuse an already signed-in HP System Management Homepage administrator’s browser to submit account-creation requests. In business terms, a tricked administrator could unintentionally create a new administrative account for an attacker. Exposure is limited to environments running HP System Management Homepage 6.2.2.7, especially where administrators access SMH through browsers while authenticated. The supplied data does not identify other affected versions or CPEs. Prioritize discovery and remediation where HP SMH manages critical servers or is reachable beyond a restricted admin network. The impact is serious because the described outcome is unauthorized administrator account creation, but evidence is incomplete on patch status and exploitation. Mitigation focus: Identify any HP SMH 6.2.2.7 installations in server inventories.; Check HP or authoritative vendor guidance for fixed versions or supported mitigations.; Restrict SMH administrative access to trusted management networks..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.