CVE-2012-2561: HP Business Service Management (BSM) 9.12 does not properly restrict the uploading of .war files, which all...

Security readout for executives and security teams

HP Business Service Management 9.12 has a weakness that may let a remote attacker upload application code and run arbitrary JSP code inside its JBoss application server. For executives, this is most concerning where legacy BSM systems or related management ports are reachable from untrusted networks. Exposure is most likely in organizations still running HP BSM 9.12, especially if JBoss-related management services on TCP 1098, 1099, or 4444 are reachable beyond trusted administration networks. Prioritize quickly if HP BSM 9.12 is still present or reachable from less-trusted networks. The business risk is server-side code execution on an operations platform, but urgency depends on exposure because the bundle does not confirm active exploitation. Mitigation focus: Check HP advisory HPSBMU02792 and current vendor guidance for supported remediation.; Remove public access to TCP 1098, 1099, and 4444 on BSM hosts.; Restrict management interfaces to trusted administrative networks only..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.