CVE-2020-7139 : Potential remote access security vulnerabilities have been identified with HPE N

Potential remote access security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker to access and modify sensitive information on the system. The following NimbleOS versions, and all subsequent releases, contain a software fix for this vulnerability: 3.9.3.0 4.5.6.0 5.0.9.0 5.1.4.100

Published 2020-05-19 23:15:10

Updated 2021-07-21 11:39:24

Source Hewlett Packard Enterprise (HPE)

View at NVD, CVE.org

Products affected by CVE-2020-7139

HPE » Nimbleos
Versions from including (>=) 4.1.0.0 and up to, including, (<=) 4.5.6.0
cpe:2.3:o:hpe:nimbleos:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Nimble Storage Af20 All Flash Array » Version: N/A
When used together with: HPE » Nimble Storage Af20q All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af40 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af60 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af80 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Cs3000 » Version: N/A
When used together with: HPE » Nimble Storage Cs5000 » Version: N/A
When used together with: HPE » Nimble Storage Cs7000 » Version: N/A
When used together with: HPE » Nimble Storage Secondary Flash Arrays » Version: N/A
HPE » Nimbleos
Versions from including (>=) 5.1.0.0 and up to, including, (<=) 5.1.4.100
cpe:2.3:o:hpe:nimbleos:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Nimble Storage Af20 All Flash Array » Version: N/A
When used together with: HPE » Nimble Storage Af20q All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af40 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af60 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af80 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Cs3000 » Version: N/A
When used together with: HPE » Nimble Storage Cs5000 » Version: N/A
When used together with: HPE » Nimble Storage Cs7000 » Version: N/A
When used together with: HPE » Nimble Storage Secondary Flash Arrays » Version: N/A
HPE » Nimbleos
Versions from including (>=) 3.1.0.0 and up to, including, (<=) 3.9.3.0
cpe:2.3:o:hpe:nimbleos:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Nimble Storage Af20 All Flash Array » Version: N/A
When used together with: HPE » Nimble Storage Af20q All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af40 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af60 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af80 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Cs3000 » Version: N/A
When used together with: HPE » Nimble Storage Cs5000 » Version: N/A
When used together with: HPE » Nimble Storage Cs7000 » Version: N/A
When used together with: HPE » Nimble Storage Secondary Flash Arrays » Version: N/A
HPE » Nimbleos
Versions from including (>=) 5.0.1.0 and up to, including, (<=) 5.0.9.0
cpe:2.3:o:hpe:nimbleos:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Nimble Storage Af20 All Flash Array » Version: N/A
When used together with: HPE » Nimble Storage Af20q All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af40 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af60 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Af80 All Flash Dual Controller » Version: N/A
When used together with: HPE » Nimble Storage Cs3000 » Version: N/A
When used together with: HPE » Nimble Storage Cs5000 » Version: N/A
When used together with: HPE » Nimble Storage Cs7000 » Version: N/A
When used together with: HPE » Nimble Storage Secondary Flash Arrays » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-7139

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-7139

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:N	8.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	2.8	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

References for CVE-2020-7139

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03991en_us

HPESBST03991 rev.1 - HPE Nimble Storage, Remote Access to Sensitive Information
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-7139

Products affected by CVE-2020-7139

Exploit prediction scoring system (EPSS) score for CVE-2020-7139

CVSS scores for CVE-2020-7139

References for CVE-2020-7139