Medium severity · published Sep 27, 2021
CVE-2021-26587
A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce. The vulnerability could be remotely exploited to cause an elevation of privilege leading to partial impact to confidentiality, availability, and integrity. HPE has made the following software update - HPE StoreOnce 4.3.0, to resolve the vulnerability in HPE StoreOnce.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HS
HPE StoreOnce 3620; HPE StoreOnce 3640; HPE StoreOnce 5200; HPE StoreOnce 5250; HPE StoreOnce 5650; HPE StoreOnce VSA 4TB ·
Firmware version: 4.2.3 and earlier; FW version: 4.2.3 and earlier · source: vendor
S3
Storeonce 3620 Firmware · Hpe
through 4.2.3 · source: NVD
S3
Storeonce 3640 Firmware · Hpe
through 4.2.3 · source: NVD
S5
Storeonce 5200 Firmware · Hpe
through 4.2.3 · source: NVD
S5
Storeonce 5250 Firmware · Hpe
through 4.2.3 · source: NVD
S5
Storeonce 5650 Firmware · Hpe
through 4.2.3 · source: NVD
SV
Storeonce Vsa 4tb Firmware · Hpe
through 4.2.3 · source: NVD
Affected product
HS
HPE StoreOnce 3620; HPE StoreOnce 3640; HPE StoreOnce 5200; HPE StoreOnce 5250; HPE StoreOnce 5650; HPE StoreOnce VSA 4TB