PT-2016-5927 · Hewlett Packard · Hpe Xp7 Command View Advanced Edition (Cvae) Suite

Published 2016-09-08 · Updated 2016-11-28 · CVE-2016-4381

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions HPE XP7 Command View Advanced Edition (CVAE) Suite versions 6.x through 8.x before 8.4.1-02

Description The issue allows local users to bypass intended access restrictions. This occurs when Replication Manager (RepMgr) and Device Manager (DevMgr) are enabled. The estimated number of potentially affected devices and details about real-world incidents are not provided.

Recommendations For versions 6.x through 8.x before 8.4.1-02, update to version 8.4.1-02 or later to resolve the issue. As a temporary workaround, consider disabling Replication Manager (RepMgr) and Device Manager (DevMgr) until the update is applied.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-4381

Affected Products

Hpe Xp7 Command View Advanced Edition (Cvae) Suite

References · 4

• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05257711 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4381 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4381 · Vendor Advisory
• http://securityfocus.com/bid/92733 · Note