Lucene search

HpeCVE-2022-23703

HistoryApr 12, 2022 - 5:15 p.m.

CVE-2022-23703

2022-04-1217:15:09

hpe

web.nvd.nist.gov

hpe nimble

storage

vulnerability

software update

nimbleos

security

cve-2022-23703

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

31.8%

JSON

A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Flash Arrays during update. This would potentially allow an attacker to intercept and modify network communication for software updates initiated by the Nimble appliance. The following NimbleOS versions, and all subsequent releases, contain a software fix for this vulnerability: 5.0.10.100, 5.2.1.500, 6.0.0.100

Affected configurations

Nvd

Node

hpenimbleosRange<5.0.10.100

hpenimbleosRange5.1.0.0–5.2.1.500

hpenimbleosMatch5.3.1.0

VendorProductVersionCPE
hpenimbleos*cpe:2.3:o:hpe:nimbleos:*:*:*:*:*:*:*:*
hpenimbleos5.3.1.0cpe:2.3:o:hpe:nimbleos:5.3.1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hpe	nimbleos	*	cpe:2.3:o:hpe:nimbleos::::::::
hpe	nimbleos	5.3.1.0	cpe:2.3:o:hpe:nimbleos:5.3.1.0:::::::*

CNA Affected

[
  {
    "product": "HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "5.3.1.0 and earlier, 5.2.1.400 and earlier and 5.0.10.0 and earlier"
      }
    ]
  }
]

References

support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04268en_us

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

31.8%

JSON

Related for CVE-2022-23703