CVE-2019-11999

Potential security vulnerabilities have been identified in HPE OpenCall Media Platform (OCMP) resulting in remote arbitrary file download and cross site scripting. HPE has made the following updates available to resolve the vulnerability in the impacted versions of OCMP. * For OCMP version 4.4.X - please upgrade to OCMP 4.4.8 and then install RP806 * For OCMP 4.5.x please contact HPE Technical Support to obtain the necessary software updates.

CVSS v3 6.9 MEDIUM
CVSS v2.0 4.9 MEDIUM

6.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:N

Exploitability : 6.8 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03984en_us	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hpe:opencall_media_platform::::::::
	cpe:2.3:a:hpe:opencall_media_platform::::::::

History

No history.

Information

Published : 2020-04-16 19:15

Updated : 2024-02-04 21:00

NVD link : CVE-2019-11999

Mitre link : CVE-2019-11999

CVE.ORG link : CVE-2019-11999

JSON object : View

Products Affected

hpe

opencall_media_platform

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2019-11999", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 1.7}]}, "published": "2020-04-16T19:15:21.073", "references": [{"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03984en_us", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Potential security vulnerabilities have been identified in HPE OpenCall Media Platform (OCMP) resulting in remote arbitrary file download and cross site scripting. HPE has made the following updates available to resolve the vulnerability in the impacted versions of OCMP. * For OCMP version 4.4.X - please upgrade to OCMP 4.4.8 and then install RP806 * For OCMP 4.5.x please contact HPE Technical Support to obtain the necessary software updates."}, {"lang": "es", "value": "Se han identificado potenciales vulnerabilidades de seguridad en HPE OpenCall Media Platform (OCMP), resultando en una descarga de archivos arbitraria remota y una vulnerabilidad de tipo cross site scripting. HPE ha puesto a disposici\u00f3n las siguientes actualizaciones para resolver la vulnerabilidad en las versiones afectadas de OCMP. * Para OCMP versi\u00f3n 4.4.X - por favor, actualice al OCMP versi\u00f3n 4.4.8 y luego instale RP806 * Para OCMP versi\u00f3n 4.5.x por favor, contacte a Soporte T\u00e9cnico de HPE para obtener las actualizaciones de software necesarias."}], "lastModified": "2020-05-01T18:03:40.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hpe:opencall_media_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0005356A-41F6-4597-A16D-B4F206164CA2", "versionEndExcluding": "4.4.8", "versionStartIncluding": "4.4.0"}, {"criteria": "cpe:2.3:a:hpe:opencall_media_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BF14B91-DD46-4286-84EF-BF5514951790", "versionEndExcluding": "4.5.2", "versionStartIncluding": "4.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}