Description

A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting (XSS) because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE Superdome Flex Servers.

Related CPE's

o

hpe

superdome_flex_firmware

Vulnerable

h

hpe

superdome_flex

-

o

hpe

superdome_flex_280_firmware

Vulnerable

h

hpe

superdome_flex_280

-

References

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04199en_us

Vendor Advisory

Weaknesses

[email protected]

Primary
CWE-732

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.1 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2021-10-19T15:15:07.533

3 years ago

Last modified

2022-07-12T17:42:04.277

2 years ago