CVE-2022-28618 Command injection in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays

Critical 9.8 Published 20 May 2022 Updated 3 Aug 2024

Attackers can execute arbitrary commands on HPE Nimble Storage appliances, requiring a software upgrade to mitigate.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-28618?

CVE-2022-28618 is a critical command injection vulnerability in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays, published on 20 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Flash Arrays that could allow an attacker to execute arbitrary commands on a Nimble appliance. HPE has made the following software updates to resolve the vulnerability in HPE Nimble Storage: 5.0.10.100 or later, 5.2.1.0 or later, 6.0.0.100 or later.

Weakness: CWE-77

Which versions are affected by CVE-2022-28618?

It affects 1 product.

Products include Hpe Nimbleos.

How do I fix CVE-2022-28618?

No fix has been published for CVE-2022-28618 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-28618 being exploited?

There is no known exploitation of CVE-2022-28618 in the wild and no public exploit code.

Sources

Also known as GHSA-xvr4-pc95-4727.