PT-2020-9230 · Hewlett Packard · Hpe Simplivity 380 Gen10 H+7

Published 2020-01-03 · Updated 2020-01-17 · CVE-2019-11994

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE SimpliVity 380 Gen 9 HPE SimpliVity 380 Gen 10 HPE SimpliVity 380 Gen 10 G HPE SimpliVity 2600 Gen 10 SimpliVity OmniCube SimpliVity OmniStack for Cisco SimpliVity OmniStack for Lenovo SimpliVity OmniStack for Dell nodes HPE OmniStack versions prior to 3.7.10

Description A security issue has been identified where an API used for executing a command manifest file during an upgrade does not correctly prevent directory traversal. This allows for the execution of manifest files in arbitrary locations on the node. The API does not require user authentication and is accessible over the management network, resulting in the potential for unauthenticated remote execution of manifest files.

Recommendations For HPE OmniStack versions prior to 3.7.10, upgrade the OmniStack software to version 3.7.10 or later. If unable to upgrade to version 3.7.10, implement the Temporary Workaround provided by HPE. All customers should upgrade to the recommended 3.7.10 or later version at the earliest convenience.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-11994

Affected Products

Hpe Omnistack

Hpe Simplivity 2600 Gen 10

Hpe Simplivity 380 Gen10 H

Hpe Simplivity 380 Gen9

Simplivity Omnicube

Simplivity Omnistack For Cisco

Simplivity Omnistack For Dell Nodes

Simplivity Omnistack For Lenovo

References · 3

• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03956en_us · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11994 · Security Note