CVE-2018-7119 Information disclosure in NonStop SAFEGAURD and NonStop H-series STDSEC-STANDARD SECURITY Product
Local attackers can read sensitive credentials passed as command-line parameters in HPE NonStop Safeguard and Standard Security software.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7119?
CVE-2018-7119 is a high-severity vulnerability in HPE NonStop SAFEGAURD and NonStop H-series STDSEC-STANDARD SECURITY Product, published on 10 May 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Local Disclosure of Sensitive Information vulnerability was identified in HPE NonStop Safeguard earlier than version SPR T9750L01^AIC or T9750H05^AIH, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND; all versions on H-series. STDSEC-STANDARD SECURITY PROD All prior versions before T6533L01^ADU or T6533H05^ADW, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND and all versions on H-series . Note that some commands in NonStop Safeguard and NonStop Standard Security software require username and password to be passed as command line parameters, which may lead to a local disclosure of the credentials.
Which versions are affected by CVE-2018-7119?
It affects 6 products.
Products include Hp Nonstop Safeguard H Series, Hp Nonstop Safeguard J Series, Hp Nonstop Safeguard L Series, Hp Nonstop Standard Security H Series, Hp Nonstop Standard Security J Series, Hp Nonstop Standard Security L Series.
How do I fix CVE-2018-7119?
No fix has been published for CVE-2018-7119 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-7119 being exploited?
There is no known exploitation of CVE-2018-7119 in the wild and no public exploit code.
Sources
Also known as GHSA-284h-g5r5-vr8m.