PT-2022-19106 · Hewlett Packard · Hpe Nimble Storage

Published 2022-05-20 · Updated 2022-06-07 · CVE-2022-28618

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE Nimble Storage versions prior to 5.0.10.100 HPE Nimble Storage versions prior to 5.2.1.0 HPE Nimble Storage versions prior to 6.0.0.100

Description A command injection security issue has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays, and HPE Nimble Storage Secondary Flash Arrays. This could allow an attacker to execute arbitrary commands on a Nimble appliance.

Recommendations For versions prior to 5.0.10.100, update to version 5.0.10.100 or later. For versions prior to 5.2.1.0, update to version 5.2.1.0 or later. For versions prior to 6.0.0.100, update to version 6.0.0.100 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-28618

Affected Products

Hpe Nimble Storage

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-28618 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28618 · Vendor Advisory
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04276en_us · Vendor Advisory
• https://t.me/cibsecurity/43102 · Telegram Post