140 lines
5.5 KiB
JSON
140 lines
5.5 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-95740",
|
|
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "hpe",
|
|
"dateReserved": "2026-09-22T14:53:19.666Z",
|
|
"datePublished": "2026-11-03T19:50:56.678Z",
|
|
"dateUpdated": "2026-11-09T12:40:09.498Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"affected": [
|
|
{
|
|
"defaultStatus": "affected",
|
|
"product": "Fabric Composer",
|
|
"vendor": "Hewlett Packard Enterprise (HPE)",
|
|
"versions": [
|
|
{
|
|
"lessThanOrEqual": "7.4.0",
|
|
"status": "affected",
|
|
"version": "7.4.0",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"lessThanOrEqual": "7.3.4",
|
|
"status": "affected",
|
|
"version": "7.0.0",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"type": "reporter",
|
|
"value": "Internal security research (HPE Networking)."
|
|
}
|
|
],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to intercept communications between the affected system and remote servers if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"attackComplexity": "HIGH",
|
|
"attackVector": "ADJACENT_NETWORK",
|
|
"baseScore": 8,
|
|
"baseSeverity": "HIGH",
|
|
"confidentialityImpact": "HIGH",
|
|
"availabilityImpact": "NONE",
|
|
"integrityImpact": "HIGH",
|
|
"privilegesRequired": "NONE",
|
|
"scope": "CHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
|
|
"version": "3.1"
|
|
},
|
|
"format": "CVSS",
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "GENERAL"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
|
|
"shortName": "hpe",
|
|
"dateUpdated": "2026-11-03T19:50:56.678Z"
|
|
},
|
|
"references": [
|
|
{
|
|
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"
|
|
}
|
|
],
|
|
"source": {
|
|
"advisory": "HPESBNW05172",
|
|
"discovery": "INTERNAL"
|
|
},
|
|
"title": "Unauthenticated Adjacent Improper Certificate Validation Vulnerability leads to Information Disclosure in HPE Networking Fabric Composer",
|
|
"x_generator": {
|
|
"engine": "Vulnogram 0.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"type": "CWE",
|
|
"cweId": "CWE-295",
|
|
"lang": "en",
|
|
"description": "CWE-295 Improper Certificate Validation"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2026-11-09T12:39:37.779844Z",
|
|
"id": "CVE-2026-95740",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-11-09T12:40:09.498Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |