Insufficient verification of data authenticity in HPE Nimble Storage Arrays

1) Insufficient verification of data authenticity

EUVDB-ID: #VU109920

Risk: Medium

CVSSv4.0: 5.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-37928

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an insufficient verification of data authenticity. A remote user can trigger the vulnerability and execute arbitrary code on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Nimble Storage Secondary Flash Array: before 5.2.1.900

Nimble Storage Hybrid Flash Arrays: before 5.2.1.900

CPE2.3

• cpe:2.3:a:hpe:nimble_storage_secondary_flash_array:*:*:*:*:*:*:*:*
• cpe:2.3:a:hpe:nimble_storage_hybrid_flash_arrays:*:*:*:*:*:*:*:*

External links

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04359en_us
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04359en_us

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.