Lucene search

[email protected]CVE-2019-12002

HistoryApr 17, 2020 - 2:15 p.m.

CVE-2019-12002

2020-04-1714:15:14

[email protected]

web.nvd.nist.gov

cve-2019-12002

remote session reuse

hpe

san storage

access restriction bypass

vulnerability

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.0%

JSON

A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA 2042 SAN Storage; HPE MSA 2050 SAN Storage; HPE MSA 2052 SAN Storage version(s): GL225P001 and earlier; GL225P001 and earlier; VE270R001-01 and earlier; GL225P001 and earlier; VL270R001-01 and earlier; VL270R001-01 and earlier.

Affected configurations

NVD

Node

hpemsa_1040_firmwareRange≤gl225p001

AND

hpemsa_1040Match-

Node

hpemsa_2040_firmwareRange≤gl225p001

AND

hpemsa_2040Match-

Node

hpemsa_2042_firmwareRange≤gl225p001

AND

hpemsa_2042Match-

Node

hpemsa_1050_firmwareRange≤ve270r001-01

AND

hpemsa_1050Match-

Node

hpemsa_2050_firmwareRange≤vl270r001-01

AND

hpemsa_2050Match-

Node

hpemsa_2052_firmwareRange≤vl270r001-01

AND

hpemsa_2052Match-

CPENameOperatorVersion
hpe:msa_1040_firmwarehpe msa 1040 firmwarelegl225p001

CPE	Name	Operator	Version
hpe:msa_1040_firmware	hpe msa 1040 firmware	le	gl225p001

CNA Affected

[
  {
    "product": "HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA 2042 SAN Storage; HPE MSA 2050 SAN Storage; HPE MSA 2052 SAN Storage",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "HPE MSA 1040 SAN Storage GL225P001 and earlier"
      },
      {
        "status": "affected",
        "version": "HPE MSA 2040 SAN Storage GL225P001 and earlier"
      },
      {
        "status": "affected",
        "version": "HPE MSA 2042 SAN Storage GL225P001 and earlier"
      },
      {
        "status": "affected",
        "version": "HPE MSA 1050 SAN Storage VE270R001-01 and earlier"
      },
      {
        "status": "affected",
        "version": "HPE MSA 2050 SAN Storage VL270R001-01 and earlier"
      },
      {
        "status": "affected",
        "version": "HPE MSA 2052 SAN Storage VL270R001-01 and earlier"
      }
    ]
  }
]

References

support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03940en_us

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.0%

JSON

Related for CVE-2019-12002

cvelist1 prion1 nvd1 nessus1