vulnwire
7.0high

CVE-2018-7119

A Local Disclosure of Sensitive Information vulnerability was identified in HPE NonStop Safeguard earlier than version SPR T9750L01^AIC or…

Published 7 y ago · modified 4 mo ago · JSON

CVSS
7.0
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 25%
Public exploits
0
none known

A Local Disclosure of Sensitive Information vulnerability was identified in HPE NonStop Safeguard earlier than version SPR T9750L01^AIC or T9750H05^AIH, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND; all versions on H-series. STDSEC-STANDARD SECURITY PROD All prior versions before T6533L01^ADU or T6533H05^ADW, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND and all versions on H-series . Note that some commands in NonStop Safeguard and NonStop Standard Security software require username and password to be passed as command line parameters, which may lead to a local disclosure of the credentials.

Exploit prediction (EPSS)

0.32% probability of exploitation in the next 30 days, higher than 25% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.0CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.01.9AV:L/AC:M/Au:N/C:P/I:N/A:N

Affected products

  • HPE NonStop SAFEGAURD and NonStop H-series STDSEC-STANDARD SECURITY Product

References

  • support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03910en_us · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.