CVE-2019-5408

Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage systems that are managed by Device Manager server. This problem is due to a vulnerability in Device Manager GUI. The following products are affected. DevMgr version 7.0.0-00 to earlier than 8.6.1-02 RepMgr if it is installed on the same machine as DevMgr TSMgr if it is installed on the same machine as DevMgr. The resolution is to upgrade to the fixed version as described below or later version of DevMgr 8.6.2-02 or later. RepMgr and TSMgr will be corrected by upgrading DevMgr.

CVSS v3 6.5 MEDIUM
CVSS v2.0 6.4 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03938en_us	Vendor Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03938en_us	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hp:xp7_device_manager::::::::
	cpe:2.3:a:hp:xp7_replication_manager:-:::::::*
	cpe:2.3:a:hp:xp7_tiered_storage_manager:-:::::::*

History

21 Nov 2024, 04:44

Type	Values Removed	Values Added
References	~~() https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03938en_us - Vendor Advisory~~	() https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03938en_us - Vendor Advisory

Information

Published : 2019-08-09 18:15

Updated : 2024-11-21 04:44

NVD link : CVE-2019-5408

Mitre link : CVE-2019-5408

CVE.ORG link : CVE-2019-5408

JSON object : View

Products Affected

hp

xp7_tiered_storage_manager
xp7_replication_manager
xp7_device_manager

CWE

NVD-CWE-noinfo

{"id": "CVE-2019-5408", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2019-08-09T18:15:12.697", "references": [{"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03938en_us", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}, {"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03938en_us", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage systems that are managed by Device Manager server. This problem is due to a vulnerability in Device Manager GUI. The following products are affected. DevMgr version 7.0.0-00 to earlier than 8.6.1-02 RepMgr if it is installed on the same machine as DevMgr TSMgr if it is installed on the same machine as DevMgr. The resolution is to upgrade to the fixed version as described below or later version of DevMgr 8.6.2-02 or later. RepMgr and TSMgr will be corrected by upgrading DevMgr."}, {"lang": "es", "value": "Los productos Command View Advanced Edition (CVAE) contienen una vulnerabilidad que podr\u00eda exponer la informaci\u00f3n de configuraci\u00f3n de hosts y sistemas de almacenamiento administrados mediante el servidor Device Manager. Este problema es debido a una vulnerabilidad en la GUI del Administrador de Dispositivos. Los siguientes productos est\u00e1n afectados. DevMgr versiones 7.0.0-00 y anteriores a 8.6.1-02, RepMgr si est\u00e1 instalado en el mismo equipo que DevMgr, TSMgr si est\u00e1 instalado en el mismo equipo que DevMgr. La resoluci\u00f3n es actualizar a versi\u00f3n corregida como se describe a continuaci\u00f3n o versi\u00f3n posterior de DevMgr 8.6.2-02 o posterior. RepMgr y TSMgr ser\u00e1n corregidos mediante la actualizaci\u00f3n de DevMgr."}], "lastModified": "2024-11-21T04:44:53.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hp:xp7_device_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CF4D741-993D-4FE0-8015-B65D2181EEA3", "versionEndExcluding": "8.6.1-02", "versionStartIncluding": "7.0.0-00"}, {"criteria": "cpe:2.3:a:hp:xp7_replication_manager:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF97AE2C-15F0-4F69-A836-EB12DFE0947F"}, {"criteria": "cpe:2.3:a:hp:xp7_tiered_storage_manager:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C074B066-8E86-4D42-AF1A-37F88F72FD33"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}