Lucene search

HpeCVE-2019-11989

HistoryJul 19, 2019 - 10:15 p.m.

CVE-2019-11989

2019-07-1922:15:11

hpe

web.nvd.nist.gov

187

security

vulnerability

hpe icewall

sso

mfa

denial of service

cve-2019-11989

remote exploit

agent option

agent module

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

40.5%

JSON

A security vulnerability in HPE IceWall SSO Agent Option and IceWall MFA (Agent module ) could be exploited remotely to cause a denial of service. The versions and platforms of Agent Option modules that are impacted are as follows: 10.0 for Apache 2.2 on RHEL 5 and 6, 10.0 for Apache 2.4 on RHEL 7, 10.0 for Apache 2.4 on HP-UX 11i v3, 10.0 for IIS on Windows, 11.0 for Apache 2.4 on RHEL 7, MFA Proxy 4.0 (Agent module only) for Apache 2.4 on RHEL 7.

Affected configurations

Nvd

Node

hpicewall_sso_agentMatch10.0apache

AND

hphp-uxMatch-

microsoftwindowsMatch-

redhatenterprise_linuxMatch5.0

redhatenterprise_linuxMatch6.0

redhatenterprise_linuxMatch7.0

Node

hpicewall_sso_agentMatch11.0apache

AND

redhatenterprise_linuxMatch7.0

Node

hpmfa_proxyMatch4.0apache

AND

redhatenterprise_linuxMatch7.0

VendorProductVersionCPE
hpicewall_sso_agent10.0cpe:2.3:a:hp:icewall_sso_agent:10.0:*:*:*:*:apache:*:*
hphp-ux-cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
redhatenterprise_linux5.0cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
redhatenterprise_linux6.0cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
redhatenterprise_linux7.0cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
hpicewall_sso_agent11.0cpe:2.3:a:hp:icewall_sso_agent:11.0:*:*:*:*:apache:*:*
hpmfa_proxy4.0cpe:2.3:a:hp:mfa_proxy:4.0:*:*:*:*:apache:*:*

Vendor	Product	Version	CPE
hp	icewall_sso_agent	10.0	cpe:2.3:a:hp:icewall_sso_agent:10.0:::::apache::
hp	hp-ux	-	cpe:2.3:o:hp:hp-ux:-:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
redhat	enterprise_linux	5.0	cpe:2.3:o:redhat:enterprise_linux:5.0:::::::*
redhat	enterprise_linux	6.0	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
redhat	enterprise_linux	7.0	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*
hp	icewall_sso_agent	11.0	cpe:2.3:a:hp:icewall_sso_agent:11.0:::::apache::
hp	mfa_proxy	4.0	cpe:2.3:a:hp:mfa_proxy:4.0:::::apache::

CNA Affected

[
  {
    "product": "IceWall SSO Agent Option; HPE IceWall MFA 4.0EE MFA. Server LTU; HPE IceWall.MFA4.0SE MFA. Server LTU",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Server LTU,10.0 (RHEL, HP-UX, Windows) and 11.0 (RHEL)"
      },
      {
        "status": "affected",
        "version": "(MFA Proxy)"
      }
    ]
  }
]

References

support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03941en_us

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

40.5%

JSON

Related for CVE-2019-11989