Lucene search

HpeCVE-2021-26589

HistoryOct 19, 2021 - 3:15 p.m.

CVE-2021-26589

2021-10-1915:15:07

CWE-732

hpe

web.nvd.nist.gov

hpe

superdome flex servers

vulnerability

xss

httponly attribute

nvd

cve-2021-26589

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.0%

JSON

A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting (XSS) because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE Superdome Flex Servers.

Affected configurations

Nvd

Node

hpesuperdome_flexMatch-

AND

hpesuperdome_flex_firmwareRange<3.40.106

Node

hpesuperdome_flex_280_firmwareRange<3.40.106

AND

hpesuperdome_flex_280Match-

VendorProductVersionCPE
hpesuperdome_flex-cpe:2.3:h:hpe:superdome_flex:-:*:*:*:*:*:*:*
hpesuperdome_flex_firmware*cpe:2.3:o:hpe:superdome_flex_firmware:*:*:*:*:*:*:*:*
hpesuperdome_flex_280_firmware*cpe:2.3:o:hpe:superdome_flex_280_firmware:*:*:*:*:*:*:*:*
hpesuperdome_flex_280-cpe:2.3:h:hpe:superdome_flex_280:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hpe	superdome_flex	-	cpe:2.3:h:hpe:superdome_flex:-:::::::*
hpe	superdome_flex_firmware	*	cpe:2.3:o:hpe:superdome_flex_firmware::::::::
hpe	superdome_flex_280_firmware	*	cpe:2.3:o:hpe:superdome_flex_280_firmware::::::::
hpe	superdome_flex_280	-	cpe:2.3:h:hpe:superdome_flex_280:-:::::::*

CNA Affected

[
  {
    "product": "HPE Superdome Flex Server",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Prior to Version 3.40.106"
      }
    ]
  }
]

References

support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04199en_us

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

34.0%

JSON

Related for CVE-2021-26589