Lucene search

HpeCVE-2022-23705

HistoryMay 09, 2022 - 9:15 p.m.

CVE-2022-23705

2022-05-0921:15:08

hpe

web.nvd.nist.gov

cve-2022-23705

hpe nimble storage

security vulnerability

unauthorized update

nvd

software update

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

32.7%

JSON

A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays, and HPE Nimble Storage Secondary Flash Arrays which could potentially allow the upload, but not execution, of unauthorized update binaries to the array. HPE has made the following software updates to resolve the vulnerability in HPE Nimble Storage: 5.0.10.100 or later, 5.2.1.0 or later, 6.0.0.100 or later.

Affected configurations

Nvd

Node

hpenimbleosRange<5.0.10.100

hpenimbleosRange5.1.0.0–5.2.1.500

hpenimbleosMatch5.3.1.0

VendorProductVersionCPE
hpenimbleos*cpe:2.3:o:hpe:nimbleos:*:*:*:*:*:*:*:*
hpenimbleos5.3.1.0cpe:2.3:o:hpe:nimbleos:5.3.1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
hpe	nimbleos	*	cpe:2.3:o:hpe:nimbleos::::::::
hpe	nimbleos	5.3.1.0	cpe:2.3:o:hpe:nimbleos:5.3.1.0:::::::*

CNA Affected

[
  {
    "product": "HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "5.0.10.0 and earlier"
      }
    ]
  }
]

References

support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04273en_us

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

32.7%

JSON

Related for CVE-2022-23705