// For flags

CVE-2019-11997

 

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A potential security vulnerability has been identified in HPE enhanced Internet Usage Manager (eIUM) versions 8.3 and 9.0. The vulnerability could be used for unauthorized access to information via cross site scripting. HPE has made the following software updates to resolve the vulnerability in eIUM. The eIUM 8.3 FP01 customers are advised to install eIUM83FP01Patch_QXCR1001711284.20190806-1244 patch. The eIUM 9.0 customers are advised to upgrade to eIUM 9.0 FP02 PI5 or later versions. For other versions, please, contact the product support.

Se ha identificado una potencial vulnerabilidad de seguridad en HPE enhanced Internet Usage Manager (eIUM) versiones 8.3 y 9.0. La vulnerabilidad podría ser usada para el acceso no autorizado a la información por medio de un ataque de tipo cross site scripting. HPE ha realizado las siguientes actualizaciones de software para resolver la vulnerabilidad en eIUM. Se recomienda a los clientes de eIUM versión 8.3 FP01 que instalen el parche eIUM83FP01Patch_QXCR1001711284.20190806-1244. Se recomienda a los clientes de eIUM versión 9.0 que actualicen a eIUM versión 9.0 FP02 PI5 o versiones posteriores. Para otras versiones, póngase en contacto con el soporte del producto.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-05-13 CVE Reserved
  • 2020-01-16 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hp
Search vendor "Hp"
 Enhanced Internet Usage Manager
Search vendor "Hp" for product "Enhanced Internet Usage Manager"
 8.3
Search vendor "Hp" for product "Enhanced Internet Usage Manager" and version "8.3"
-
Affected
Hp
Search vendor "Hp"
 Enhanced Internet Usage Manager
Search vendor "Hp" for product "Enhanced Internet Usage Manager"
 9.0
Search vendor "Hp" for product "Enhanced Internet Usage Manager" and version "9.0"
-
Affected