Vulnerability-Lookup

CNVD-2020-04654

Vulnerability from cnvd - Published: 2020-02-11

Title

多款HPE产品存在未明漏洞

Description

HPE SimpliVity 380 Gen 9等都是美国惠普企业公司（Hewlett Packard Enterprise，HPE）的一款服务器。多款HPE产品中存在安全漏洞。攻击者可利用该漏洞创建并删除任意文件。

Severity

高

Patch Name

多款HPE产品存在未明漏洞的补丁

Patch Description

HPE SimpliVity 380 Gen 9等都是美国惠普企业公司（Hewlett Packard Enterprise，HPE）的一款服务器。多款HPE产品中存在安全漏洞。攻击者可利用该漏洞创建并删除任意文件。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03955en_us

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-11993

Impacted products

Name
['HP SimpliVity 380 Gen9 >=3.6.2，<=3.7.9', 'HP SimpliVity 380 Gen10 G >=3.7.8，<=3.7.9', 'HP SimpliVity 2600 Gen10 >=3.7.5，<=3.7.9', 'HP SimpliVity OmniCube >=3.0.8，<=3.7.9', 'HP SimpliVity OmniStack for Cisco >=3.0.8，<=3.7.9', 'HP SimpliVity OmniStack for Lenovo >=3.0.8，<=3.7.9', 'HP SimpliVity OmniStack for Dell >=3.0.8，<=3.7.9']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-11993"
    }
  },
  "description": "HPE SimpliVity 380 Gen 9\u7b49\u90fd\u662f\u7f8e\u56fd\u60e0\u666e\u4f01\u4e1a\u516c\u53f8\uff08Hewlett Packard Enterprise\uff0cHPE\uff09\u7684\u4e00\u6b3e\u670d\u52a1\u5668\u3002\n\n\u591a\u6b3eHPE\u4ea7\u54c1\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u521b\u5efa\u5e76\u5220\u9664\u4efb\u610f\u6587\u4ef6\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03955en_us",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-04654",
  "openTime": "2020-02-11",
  "patchDescription": "HPE SimpliVity 380 Gen 9\u7b49\u90fd\u662f\u7f8e\u56fd\u60e0\u666e\u4f01\u4e1a\u516c\u53f8\uff08Hewlett Packard Enterprise\uff0cHPE\uff09\u7684\u4e00\u6b3e\u670d\u52a1\u5668\u3002\r\n\r\n\u591a\u6b3eHPE\u4ea7\u54c1\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u521b\u5efa\u5e76\u5220\u9664\u4efb\u610f\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eHPE\u4ea7\u54c1\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "HP SimpliVity 380 Gen9 \u003e=3.6.2\uff0c\u003c=3.7.9",
      "HP SimpliVity 380 Gen10 G \u003e=3.7.8\uff0c\u003c=3.7.9",
      "HP SimpliVity 2600 Gen10 \u003e=3.7.5\uff0c\u003c=3.7.9",
      "HP SimpliVity OmniCube \u003e=3.0.8\uff0c\u003c=3.7.9",
      "HP SimpliVity OmniStack for Cisco \u003e=3.0.8\uff0c\u003c=3.7.9",
      "HP SimpliVity OmniStack for Lenovo \u003e=3.0.8\uff0c\u003c=3.7.9",
      "HP SimpliVity OmniStack for Dell \u003e=3.0.8\uff0c\u003c=3.7.9"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-11993",
  "serverity": "\u9ad8",
  "submitTime": "2020-01-07",
  "title": "\u591a\u6b3eHPE\u4ea7\u54c1\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}

CVE-2019-11993 (GCVE-0-2019-11993)

Vulnerability from cvelistv5 – Published: 2020-01-03 17:18 – Updated: 2024-08-04 23:10

Summary

A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. Two now deprecated APIs run as root, accept a file name path, and can be used to create or delete arbitrary files on the nodes. These APIs do not require user authentication and are accessible over the management network, resulting in remote availability and integrity vulnerabilities For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=mmr_sf-EN_US000061675&withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience.

Severity

No CVSS data available.

CWE

remote creation and deletion of arbitrary files; remote creation and deletion of arbitrary files

Assigner

hpe mitre root

References

1 reference

URL	Tags
https://support.hpe.com/hpsc/doc/public/display?d…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	SimpliVity OmniCube; HPE SimpliVity 380 Gen9; HPE SimpliVity 380 Gen9; HPE SimpliVity 380 Gen10; HPE SimpliVity 380 Gen10 G; SimpliVity OmniStack for Lenovo; SimpliVity OmniStack for Cisco; SimpliVity OmniStack for Dell; HPE SimpliVity 2600 Gen10	Affected: releases from 3.0.8 to 3.7.9 Affected: releases from 3.6.2 to 3.7.9 Affected: releases from 3.7.1 to 3.7.9 Affected: releases from 3.7.8 to 3.7.9 Affected: releases from 3.7.5 to 3.7.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:10:30.154Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03955en_us"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SimpliVity OmniCube; HPE SimpliVity 380 Gen9; HPE SimpliVity 380 Gen9; HPE SimpliVity 380 Gen10; HPE SimpliVity 380 Gen10 G; SimpliVity OmniStack for Lenovo; SimpliVity OmniStack for Cisco; SimpliVity OmniStack for Dell; HPE SimpliVity 2600 Gen10",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "releases from 3.0.8 to 3.7.9"
            },
            {
              "status": "affected",
              "version": "releases from 3.6.2 to 3.7.9"
            },
            {
              "status": "affected",
              "version": "releases from 3.7.1 to 3.7.9"
            },
            {
              "status": "affected",
              "version": "releases from 3.7.8 to 3.7.9"
            },
            {
              "status": "affected",
              "version": "releases from 3.7.5 to 3.7.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. Two now deprecated APIs run as root, accept a file name path, and can be used to create or delete arbitrary files on the nodes. These APIs do not require user authentication and are accessible over the management network, resulting in remote availability and integrity vulnerabilities For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=mmr_sf-EN_US000061675\u0026withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "remote creation and deletion of arbitrary files; remote creation and deletion of arbitrary files",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-03T17:18:03.000Z",
        "orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
        "shortName": "hpe"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03955en_us"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-alert@hpe.com",
          "ID": "CVE-2019-11993",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SimpliVity OmniCube; HPE SimpliVity 380 Gen9; HPE SimpliVity 380 Gen9; HPE SimpliVity 380 Gen10; HPE SimpliVity 380 Gen10 G; SimpliVity OmniStack for Lenovo; SimpliVity OmniStack for Cisco; SimpliVity OmniStack for Dell; HPE SimpliVity 2600 Gen10",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "releases from 3.0.8 to 3.7.9"
                          },
                          {
                            "version_value": "releases from 3.6.2 to 3.7.9"
                          },
                          {
                            "version_value": "releases from 3.7.1 to 3.7.9"
                          },
                          {
                            "version_value": "releases from 3.7.8 to 3.7.9"
                          },
                          {
                            "version_value": "releases from 3.0.8 to 3.7.9"
                          },
                          {
                            "version_value": "releases from 3.0.8 to 3.7.9"
                          },
                          {
                            "version_value": "releases from 3.0.8 to 3.7.9"
                          },
                          {
                            "version_value": "releases from 3.7.5 to 3.7.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380 Gen 10 G, HPE SimpliVity 2600 Gen 10, SimpliVity OmniCube, SimpliVity OmniStack for Cisco, SimpliVity OmniStack for Lenovo and SimpliVity OmniStack for Dell nodes. Two now deprecated APIs run as root, accept a file name path, and can be used to create or delete arbitrary files on the nodes. These APIs do not require user authentication and are accessible over the management network, resulting in remote availability and integrity vulnerabilities For all customers running HPE OmniStack version 3.7.9 and earlier. HPE recommends upgrading the OmniStack software to version 3.7.10 or later, which contains a permanent resolution. Customers and partners who can upgrade to 3.7.10 should upgrade at the earliest convenience. For all customers and partners unable to upgrade their environments to the recommended version 3.7.10, HPE has created a Temporary Workaround https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=mmr_sf-EN_US000061675\u0026withFrame for you to implement. All customer should upgrade to the recommended 3.7.10 or later version at the earliest convenience."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "remote creation and deletion of arbitrary files; remote creation and deletion of arbitrary files"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03955en_us",
              "refsource": "MISC",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03955en_us"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
    "assignerShortName": "hpe",
    "cveId": "CVE-2019-11993",
    "datePublished": "2020-01-03T17:18:03.000Z",
    "dateReserved": "2019-05-13T00:00:00.000Z",
    "dateUpdated": "2024-08-04T23:10:30.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2020-04654

CVE-2019-11993 (GCVE-0-2019-11993)

Tags

Sightings

Nomenclature

Related by attack behaviour