Lucene search

[email protected]CVE-2019-11994

HistoryJan 03, 2020 - 6:15 p.m.

CVE-2019-11994

2020-01-0318:15:09

CWE-22

[email protected]

web.nvd.nist.gov

127

security

vulnerability

hpe simplivity

remote execution

unauthenticated

api

directory traversal

upgrade

manifest file

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.012 Low

EPSS

Percentile

85.0%

JSON

A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. An API is used to execute a command manifest file during upgrade does not correctly prevent directory traversal and so can be used to execute manifest files in arbitrary locations on the node. The API does not require user authentication and is accessible over the management network, resulting in the potential for unauthenticated remote execution of manifest files. For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=mmr_sf-EN_US000061901&withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience.

Affected configurations

NVD

Node

hpsimplivity_380_gen9_firmwareRange3.6.2–3.7.9

AND

hpsimplivity_380_gen9Match-

Node

hpsimplivity_380_gen10_gMatch-

AND

hpsimplivity_380_gen10_g_firmwareRange3.7.8–3.7.9

Node

hpsimplivity_380_gen10Match-

AND

hpsimplivity_380_gen10_firmwareRange3.7.1–3.7.9

Node

hpsimplivity_2600_gen10Match-

AND

hpsimplivity_2600_gen10_firmwareRange3.7.5–3.7.9

Node

hpsimplivity_omnicubeMatch-

AND

hpsimplivity_omnicube_firmwareRange3.5.2–3.7.9

Node

hpsimplivity_omnistack_for_dellMatch-

AND

hpsimplivity_omnistack_for_dell_firmwareRange3.5.2–3.7.9

Node

hpsimplivity_omnistack_for_ciscoMatch-

AND

hpsimplivity_omnistack_for_cisco_firmwareRange3.5.2–3.7.9

Node

hpsimplivity_omnistack_for_lenovoMatch-

AND

hpsimplivity_omnistack_for_lenovo_firmwareRange3.5.2–3.7.9

CPENameOperatorVersion
hp:simplivity_380_gen9_firmwarehp simplivity 380 gen9 firmwarele3.7.9

CPE	Name	Operator	Version
hp:simplivity_380_gen9_firmware	hp simplivity 380 gen9 firmware	le	3.7.9

CNA Affected

[
  {
    "product": "HPE SimpliVity 2600 Gen10; HPE SimpliVity 380 Gen10; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 380 Gen9; SimpliVity OmniCube; SimpliVity OmniStack for Cisco; SimpliVity OmniStack for Dell; SimpliVity OmniStack for Lenovo",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "releases from 3.5.2 to 3.7.9"
      },
      {
        "status": "affected",
        "version": "releases from 3.6.2 to 3.7.9"
      },
      {
        "status": "affected",
        "version": "releases from 3.7.1 to 3.7.9"
      },
      {
        "status": "affected",
        "version": "releases from 3.7.8 to 3.7.9"
      },
      {
        "status": "affected",
        "version": "releases from 3.7.5 to 3.7.9"
      }
    ]
  }
]

References

support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03956en_us

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.012 Low

EPSS

Percentile

85.0%

JSON

Related for CVE-2019-11994

prion1 cvelist1 nvd1