Lucene search

[email protected]CVE-2018-7111

HistoryOct 17, 2018 - 1:29 p.m.

CVE-2018-7111

2018-10-1713:29:00

[email protected]

web.nvd.nist.gov

cve-2018-7111

hpe

uiot

vulnerability

remote access

nvd

dsm portal

dsm apis

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.7%

JSON

A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2. Specifically, there is a malfunction identified in some section of the DSM portal and some DSM APIs. The impact of the malfunction is that the info can be changed by other users.

Affected configurations

NVD

Node

hpuniversal_internet_of_thingsMatch1.2.4.2

hpuniversal_internet_of_thingsMatch1.4.0

hpuniversal_internet_of_thingsMatch1.4.1

hpuniversal_internet_of_thingsMatch1.4.2

hpuniversal_internet_of_thingsMatch1.5

CPENameOperatorVersion
hp:universal_internet_of_thingshp universal internet of thingseq1.2.4.2
hp:universal_internet_of_thingshp universal internet of thingseq1.4.0
hp:universal_internet_of_thingshp universal internet of thingseq1.4.1
hp:universal_internet_of_thingshp universal internet of thingseq1.4.2
hp:universal_internet_of_thingshp universal internet of thingseq1.5

CPE	Name	Operator	Version
hp:universal_internet_of_things	hp universal internet of things	eq	1.2.4.2
hp:universal_internet_of_things	hp universal internet of things	eq	1.4.0
hp:universal_internet_of_things	hp universal internet of things	eq	1.4.1
hp:universal_internet_of_things	hp universal internet of things	eq	1.4.2
hp:universal_internet_of_things	hp universal internet of things	eq	1.5

CNA Affected

[
  {
    "product": "HPE UIoT",
    "vendor": "Hewlett Packard Enterprise",
    "versions": [
      {
        "status": "affected",
        "version": "versions 1.5,1.4.0, 1.4.1, 1.4.2, 1.2.4.2"
      }
    ]
  }
]

References

www.securityfocus.com/bid/105704

exchange.xforce.ibmcloud.com/vulnerabilities/151691

support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03891en_us

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.7%

JSON

Related for CVE-2018-7111

prion1 cvelist1 nvd1