CVE-2019-12001

Severity Score

6.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA 2042 SAN Storage; HPE MSA 2050 SAN Storage; HPE MSA 2052 SAN Storage version(s): GL225P001 and earlier; GL225P001 and earlier; VE270R001-01 and earlier; GL225P001 and earlier; VL270R001-01 and earlier; VL270R001-01 and earlier.

Se detectó una vulnerabilidad de reutilización de sesión remota que conllevó a omitir una restricción de acceso en HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA 2042 SAN Storage; HPE MSA 2050 SAN Storage; HPE MSA 2052 SAN Storage versiones: GL225P001 y anteriores; GL225P001 y anteriores; VE270R001-01 y anteriores; GL225P001 y anteriores; VL270R001-01 y anteriores; VL270R001-01 y anteriores.

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

High

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-05-13 CVE Reserved
2020-04-17 CVE Published
2023-03-07 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-613: Insufficient Session Expiration

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03940en_us	2020-04-28

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Hpe Search vendor "Hpe"	Msa 1040 Firmware Search vendor "Hpe" for product "Msa 1040 Firmware"	<= gl225p001 Search vendor "Hpe" for product "Msa 1040 Firmware" and version " <= gl225p001"	-	Affected	in	Hpe Search vendor "Hpe"	Msa 1040 Search vendor "Hpe" for product "Msa 1040"	-	-	Safe
Hpe Search vendor "Hpe"	Msa 2040 Firmware Search vendor "Hpe" for product "Msa 2040 Firmware"	<= gl225p001 Search vendor "Hpe" for product "Msa 2040 Firmware" and version " <= gl225p001"	-	Affected	in	Hpe Search vendor "Hpe"	Msa 2040 Search vendor "Hpe" for product "Msa 2040"	-	-	Safe
Hpe Search vendor "Hpe"	Msa 2042 Firmware Search vendor "Hpe" for product "Msa 2042 Firmware"	<= gl225p001 Search vendor "Hpe" for product "Msa 2042 Firmware" and version " <= gl225p001"	-	Affected	in	Hpe Search vendor "Hpe"	Msa 2042 Search vendor "Hpe" for product "Msa 2042"	-	-	Safe
Hpe Search vendor "Hpe"	Msa 1050 Firmware Search vendor "Hpe" for product "Msa 1050 Firmware"	<= ve270r001-01 Search vendor "Hpe" for product "Msa 1050 Firmware" and version " <= ve270r001-01"	-	Affected	in	Hpe Search vendor "Hpe"	Msa 1050 Search vendor "Hpe" for product "Msa 1050"	-	-	Safe
Hpe Search vendor "Hpe"	Msa 2050 Firmware Search vendor "Hpe" for product "Msa 2050 Firmware"	<= vl270r001-01 Search vendor "Hpe" for product "Msa 2050 Firmware" and version " <= vl270r001-01"	-	Affected	in	Hpe Search vendor "Hpe"	Msa 2050 Search vendor "Hpe" for product "Msa 2050"	-	-	Safe
Hpe Search vendor "Hpe"	Msa 2052 Firmware Search vendor "Hpe" for product "Msa 2052 Firmware"	<= vl270r001-01 Search vendor "Hpe" for product "Msa 2052 Firmware" and version " <= vl270r001-01"	-	Affected	in	Hpe Search vendor "Hpe"	Msa 2052 Search vendor "Hpe" for product "Msa 2052"	-	-	Safe