Lucene search

HpeCVE-2019-11996

HistoryNov 07, 2019 - 7:15 p.m.

CVE-2019-11996

2019-11-0719:15:14

hpe

web.nvd.nist.gov

hpe

nimble storage

cve-2019-11996

security vulnerability

privilege escalation

nimbleos

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

Potential security vulnerabilities have been identified with HPE Nimble Storage systems in multi array group configurations. The vulnerabilities could be exploited by an attacker to gain elevated privileges on the array. The following NimbleOS versions, and all subsequent releases, contain a software fix for this vulnerability: 3.9.2.0, 4.5.5.0, 5.0.8.0 and 5.1.3.0.

Affected configurations

Nvd

Node

hpenimble_storage_af20_all_flash_arrayMatch-

hpenimble_storage_af20q_all_flash_dual_controllerMatch-

hpenimble_storage_af40_all_flash_dual_controllerMatch-

hpenimble_storage_af60_all_flash_dual_controllerMatch-

hpenimble_storage_af80_all_flash_dual_controllerMatch-

hpenimble_storage_cs3000Match-

hpenimble_storage_cs5000Match-

hpenimble_storage_cs7000Match-

hpenimble_storage_secondary_flash_arraysMatch-

AND

hpenimbleosRange3.1.0.0–3.9.1.0

hpenimbleosRange4.1.0.0–4.5.4.0

hpenimbleosRange5.0.1.0–5.0.7.0

hpenimbleosRange5.1.0.0–5.1.2.0

VendorProductVersionCPE
hpenimble_storage_af20_all_flash_array-cpe:2.3:h:hpe:nimble_storage_af20_all_flash_array:-:*:*:*:*:*:*:*
hpenimble_storage_af20q_all_flash_dual_controller-cpe:2.3:h:hpe:nimble_storage_af20q_all_flash_dual_controller:-:*:*:*:*:*:*:*
hpenimble_storage_af40_all_flash_dual_controller-cpe:2.3:h:hpe:nimble_storage_af40_all_flash_dual_controller:-:*:*:*:*:*:*:*
hpenimble_storage_af60_all_flash_dual_controller-cpe:2.3:h:hpe:nimble_storage_af60_all_flash_dual_controller:-:*:*:*:*:*:*:*
hpenimble_storage_af80_all_flash_dual_controller-cpe:2.3:h:hpe:nimble_storage_af80_all_flash_dual_controller:-:*:*:*:*:*:*:*
hpenimble_storage_cs3000-cpe:2.3:h:hpe:nimble_storage_cs3000:-:*:*:*:*:*:*:*
hpenimble_storage_cs5000-cpe:2.3:h:hpe:nimble_storage_cs5000:-:*:*:*:*:*:*:*
hpenimble_storage_cs7000-cpe:2.3:h:hpe:nimble_storage_cs7000:-:*:*:*:*:*:*:*
hpenimble_storage_secondary_flash_arrays-cpe:2.3:h:hpe:nimble_storage_secondary_flash_arrays:-:*:*:*:*:*:*:*
hpenimbleos*cpe:2.3:o:hpe:nimbleos:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hpe	nimble_storage_af20_all_flash_array	-	cpe:2.3:h:hpe:nimble_storage_af20_all_flash_array:-:::::::*
hpe	nimble_storage_af20q_all_flash_dual_controller	-	cpe:2.3:h:hpe:nimble_storage_af20q_all_flash_dual_controller:-:::::::*
hpe	nimble_storage_af40_all_flash_dual_controller	-	cpe:2.3:h:hpe:nimble_storage_af40_all_flash_dual_controller:-:::::::*
hpe	nimble_storage_af60_all_flash_dual_controller	-	cpe:2.3:h:hpe:nimble_storage_af60_all_flash_dual_controller:-:::::::*
hpe	nimble_storage_af80_all_flash_dual_controller	-	cpe:2.3:h:hpe:nimble_storage_af80_all_flash_dual_controller:-:::::::*
hpe	nimble_storage_cs3000	-	cpe:2.3:h:hpe:nimble_storage_cs3000:-:::::::*
hpe	nimble_storage_cs5000	-	cpe:2.3:h:hpe:nimble_storage_cs5000:-:::::::*
hpe	nimble_storage_cs7000	-	cpe:2.3:h:hpe:nimble_storage_cs7000:-:::::::*
hpe	nimble_storage_secondary_flash_arrays	-	cpe:2.3:h:hpe:nimble_storage_secondary_flash_arrays:-:::::::*
hpe	nimbleos	*	cpe:2.3:o:hpe:nimbleos::::::::

CNA Affected

[
  {
    "product": "HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "5.1.2.0 and older, 5.0.7.0 and older, 4.5.4.0 and older, 3.9.1.0 and older"
      }
    ]
  }
]

References

support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03964en_us

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

Related for CVE-2019-11996