Critical severity · published Apr 17, 2020
CVE-2019-12002
A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA…
9.8
CVSS
2.2%
EPSS
No
On KEV
Description
A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA 2042 SAN Storage; HPE MSA 2050 SAN Storage; HPE MSA 2052 SAN Storage version(s): GL225P001 and earlier; GL225P001 and earlier; VE270R001-01 and earlier; GL225P001 and earlier; VL270R001-01 and earlier; VL270R001-01 and earlier.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
M1
Msa 1040 Firmware · Hpe
through gl225p001 · source: NVD
M1
Msa 1050 Firmware · Hpe
through ve270r001-01 · source: NVD
M2
Msa 2040 Firmware · Hpe
through gl225p001 · source: NVD
M2
Msa 2042 Firmware · Hpe
through gl225p001 · source: NVD
M2
Msa 2050 Firmware · Hpe
through vl270r001-01 · source: NVD
M2
Msa 2052 Firmware · Hpe
through vl270r001-01 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12002
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12002
Vendor Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03940en_us
More from Msa 1040 Firmware
6.4
CVE-2019-12001
A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA…