Unrestricted file upload in Hewlett Packard Enterprise Version Control Repository Manager
Priority MEDIUM 42CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-434.
Summary
A remote malicious file upload vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6.
Why it matters now
EPSS 0.01919 80th percentileScored 2026-11-07
Fix Fixed Version Control Repository Manager (VCRM) (Hewlett Packard Enterprise): 7.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hewlett Packard Enterprise | Version Control Repository Manager (VCRM) | before 7.6 | 7.6 | Patch available | CNA |
- Version Control Repository Manager (VCRM) VendorHewlett Packard Enterprise Affected before 7.6 Fixed in 7.6 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hp:version_control_repository_manager:*:*:*:*:*:*:*:* | before 7.6 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:a:hp:version_control_repository_manager:*:*:*:*:*:*:*:* Versions before 7.6 Vulnerable ·Hewlett Packard Enterprise
Remediation
- Fix · CNA Version Control Repository Manager (VCRM) (Hewlett Packard Enterprise) Fixed in 7.6
Timeline
- 2026-10-02 Threatist record created from CVE-2016-8515
- 2026-10-03 Alias added: GHSA-37rf-3x46-75w9
References
More Hewlett Packard Enterprise Version Control Repository Manager vulnerabilities
- TI-2015-02747 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-07113 Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before… KEVCVSS 3.1HIGH 8.8
- TI-2015-04551 Buffer overflow in HP Version Control Repository Manager (VCRM) before 7.5.0 allows… CVSS 2.0HIGH 7.5
- TI-2016-07011 Cross-site request forgery in Hewlett Packard Enterprise Version Control Repository… CVSS 3.0HIGH 8.0
- TI-2015-04553 HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated… CVSS 2.0MEDIUM 6.8
- TI-2015-04552 HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated… CVSS 2.0MEDIUM 6.5
Sources
- CVE-2016-8515 · CVE Program
- CVE-2016-8515 · NVD
- FIRST EPSS
- GHSA-37rf-3x46-75w9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences