Vulnerability in HPE Superdome Flex
CVE-2021-26589
A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting (XSS) because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE Superdome Flex Servers.
EPSS: 0.005 (41.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Hpe Superdome_flex
- Hpe Superdome_flex_280
- Hpe Superdome_flex_280_firmware
- Hpe Superdome_flex_firmware
- N/a Hpe Superdome Flex Server — versions Prior to Version 3.40.106
Weakness classification (CWE)
References
- security-alert@hpe.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-26589?
- CVE-2021-26589 is a medium-severity vulnerability in HPE Superdome Flex, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 6.1/10. Published 2021-10-19.
- How severe is CVE-2021-26589?
- Medium severity. CVSS v3 base score is 6.1 out of 10.