HPE MSA SAN Storage VSS Provider and CAPI Proxy Software unquoted search path

Summaryinfo

A vulnerability has been found in HPE MSA SAN Storage VSS Provider and CAPI Proxy Software up to 4.1.3.82 and classified as critical. This affects an unknown function. Performing a manipulation results in unquoted search path. This vulnerability is reported as CVE-2024-22437. The attack requires a local approach. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in HPE MSA SAN Storage VSS Provider and CAPI Proxy Software up to 4.1.3.82. This affects an unknown part. The manipulation with an unknown input leads to a unquoted search path vulnerability. CWE is classifying the issue as CWE-428. The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A potential security vulnerability has been identified in VSS Provider and CAPI Proxy software for certain HPE MSA storage products. This vulnerability could be exploited to gain elevated privilege on the system.

The advisory is shared at support.hpe.com. This vulnerability is uniquely identified as CVE-2024-22437 since 01/10/2024. The exploitability is told to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/15/2024). MITRE ATT&CK project uses the attack technique T1574.009 for this issue.

Upgrading to version 4.1.3.83 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• HPE

Name

• MSA SAN Storage VSS Provider and CAPI Proxy Software

Version

• 4.1.3.0
• 4.1.3.1
• 4.1.3.2
• 4.1.3.3
• 4.1.3.4
• 4.1.3.5
• 4.1.3.6
• 4.1.3.7
• 4.1.3.8
• 4.1.3.9
• 4.1.3.10
• 4.1.3.11
• 4.1.3.12
• 4.1.3.13
• 4.1.3.14
• 4.1.3.15
• 4.1.3.16
• 4.1.3.17
• 4.1.3.18
• 4.1.3.19
• 4.1.3.20
• 4.1.3.21
• 4.1.3.22
• 4.1.3.23
• 4.1.3.24
• 4.1.3.25
• 4.1.3.26
• 4.1.3.27
• 4.1.3.28
• 4.1.3.29
• 4.1.3.30
• 4.1.3.31
• 4.1.3.32
• 4.1.3.33
• 4.1.3.34
• 4.1.3.35
• 4.1.3.36
• 4.1.3.37
• 4.1.3.38
• 4.1.3.39
• 4.1.3.40
• 4.1.3.41
• 4.1.3.42
• 4.1.3.43
• 4.1.3.44
• 4.1.3.45
• 4.1.3.46
• 4.1.3.47
• 4.1.3.48
• 4.1.3.49
• 4.1.3.50
• 4.1.3.51
• 4.1.3.52
• 4.1.3.53
• 4.1.3.54
• 4.1.3.55
• 4.1.3.56
• 4.1.3.57
• 4.1.3.58
• 4.1.3.59
• 4.1.3.60
• 4.1.3.61
• 4.1.3.62
• 4.1.3.63
• 4.1.3.64
• 4.1.3.65
• 4.1.3.66
• 4.1.3.67
• 4.1.3.68
• 4.1.3.69
• 4.1.3.70
• 4.1.3.71
• 4.1.3.72
• 4.1.3.73
• 4.1.3.74
• 4.1.3.75
• 4.1.3.76
• 4.1.3.77
• 4.1.3.78
• 4.1.3.79
• 4.1.3.80
• 4.1.3.81
• 4.1.3.82

License

• commercial

Website

• Vendor: https://www.hpe.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion