VulnerabilityModified

CVE-2021-26589

A potential security vulnerability has been identified in HPE Superdome Flex Servers.

MEDIUM 6.1EPSS 0.55%

Does this matter?

Lower severity and a low EPSS score (0.55%). Track it; it rarely justifies an emergency change on its own.

Description

A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting (XSS) because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE Superdome Flex Servers.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.55% probability · 44th percentile
CISA KEV: Not listed
Weakness: CWE-732
Affected: hpe/superdome flex firmware · hpe/superdome flex 280 firmware
Source: security-alert@hpe.com

References

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04199en_usVendor Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04199en_usVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.