CVE-2019-11993

Summary

CVE	CVE-2019-11993
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-01-03 18:15:00 UTC
Updated	2020-01-21 20:41:00 UTC
Description	A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. Two now deprecated APIs run as root, accept a file name path, and can be used to create or delete arbitrary files on the nodes. These APIs do not require user authentication and are accessible over the management network, resulting in remote availability and integrity vulnerabilities For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=mmr_sf-EN_US000061675&withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience.

Problem Types: NVD-CWE-noinfo

Type	Vendor	Product	Version	Update	Edition	Language
Hardware	Hp	Simplivity 2600 Gen10	-	All	All	All
Hardware	Hp	Simplivity 2600 Gen10	-	All	All	All
Operating System	Hp	Simplivity 2600 Gen10 Firmware	All	All	All	All
Hardware	Hp	Simplivity 380 Gen10	-	All	All	All
Hardware	Hp	Simplivity 380 Gen10	-	All	All	All
Operating System	Hp	Simplivity 380 Gen10 Firmware	All	All	All	All
Hardware	Hp	Simplivity 380 Gen10 G	-	All	All	All
Hardware	Hp	Simplivity 380 Gen10 G	-	All	All	All
Operating System	Hp	Simplivity 380 Gen10 G Firmware	All	All	All	All
Hardware	Hp	Simplivity 380 Gen9	-	All	All	All
Hardware	Hp	Simplivity 380 Gen9	-	All	All	All
Operating System	Hp	Simplivity 380 Gen9 Firmware	All	All	All	All
Hardware	Hp	Simplivity Omnicube	-	All	All	All
Hardware	Hp	Simplivity Omnicube	-	All	All	All
Operating System	Hp	Simplivity Omnicube Firmware	All	All	All	All
Hardware	Hp	Simplivity Omnistack For Cisco	-	All	All	All
Hardware	Hp	Simplivity Omnistack For Cisco	-	All	All	All
Operating System	Hp	Simplivity Omnistack For Cisco Firmware	All	All	All	All
Hardware	Hp	Simplivity Omnistack For Dell	-	All	All	All
Hardware	Hp	Simplivity Omnistack For Dell	-	All	All	All
Operating System	Hp	Simplivity Omnistack For Dell Firmware	All	All	All	All
Hardware	Hp	Simplivity Omnistack For Lenovo	-	All	All	All
Hardware	Hp	Simplivity Omnistack For Lenovo	-	All	All	All
Operating System	Hp	Simplivity Omnistack For Lenovo Firmware	All	All	All	All

Reference	Source	Link	Tags
Document Display \| HPE Support Center	MISC	support.hpe.com	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.