CVE-2019-11998

HPE Superdome Flex Server is vulnerable to multiple remote vulnerabilities via improper input validation of administrator commands. This vulnerability could allow an Administrator to bypass security restrictions and access multiple remote vulnerabilities including information disclosure, or denial of service. HPE has provided firmware updates that address the above vulnerabilities for the HPE Superdome Flex Server starting with firmware version v3.20.186 (not available online) and v3.20.206 (available online). Apply v3.20.206 (4 December 2019) or a newer version to resolve this issue. Please visit HPE Support Center https://support.hpe.com/hpesc/public/home to obtain the updated firmware for your product.

CVSS v3 5.5 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03978en_us	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:hpe:superdome_flex_server_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hpe:superdome_flex_server:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-01-16 19:15

Updated : 2024-02-28 17:28

NVD link : CVE-2019-11998

Mitre link : CVE-2019-11998

CVE.ORG link : CVE-2019-11998

JSON object : View

Products Affected

hpe

superdome_flex_server
superdome_flex_server_firmware

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2019-11998", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2020-01-16T19:15:12.077", "references": [{"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03978en_us", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "HPE Superdome Flex Server is vulnerable to multiple remote vulnerabilities via improper input validation of administrator commands. This vulnerability could allow an Administrator to bypass security restrictions and access multiple remote vulnerabilities including information disclosure, or denial of service. HPE has provided firmware updates that address the above vulnerabilities for the HPE Superdome Flex Server starting with firmware version v3.20.186 (not available online) and v3.20.206 (available online). Apply v3.20.206 (4 December 2019) or a newer version to resolve this issue. Please visit HPE Support Center https://support.hpe.com/hpesc/public/home to obtain the updated firmware for your product."}, {"lang": "es", "value": "El servidor HPE Superdome Flex es vulnerable a m\u00faltiples vulnerabilidades remotas por medio de una comprobaci\u00f3n de entrada inapropiada de los comandos de administrador. Esta vulnerabilidad podr\u00eda permitir a un Administrador omitir las restricciones de seguridad y acceder a m\u00faltiples vulnerabilidades remotas, incluyendo una divulgaci\u00f3n de informaci\u00f3n o una denegaci\u00f3n de servicio. HPE ha proporcionado actualizaciones de firmware que abordan las vulnerabilidades anteriores para el servidor HPE Superdome Flex Server comenzando con las versiones de firmware v3.20.186 (no disponible en l\u00ednea) y v3.20.206 (disponible en l\u00ednea). Aplique la versi\u00f3n v3.20.206 (4 de diciembre de 2019) o una versi\u00f3n m\u00e1s nueva para resolver este problema. Por favor visite el Centro de Soporte de HPE https://support.hpe.com/hpesc/public/home para obtener el firmware actualizado para su producto."}], "lastModified": "2020-01-29T14:31:06.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hpe:superdome_flex_server_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB8A5996-9312-4EE1-ABF0-4C52A4A4CA0E", "versionEndExcluding": "3.20.186"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hpe:superdome_flex_server:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "74B3DA6F-91D3-4C17-A34B-6AA6B9642B3F"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security-alert@hpe.com"}