140 lines
5.3 KiB
JSON
140 lines
5.3 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-95772",
|
|
"assignerOrgId": "eb103674-0d28-4225-80f8-39fb86215de0",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "hpe",
|
|
"dateReserved": "2026-09-22T14:54:32.623Z",
|
|
"datePublished": "2026-11-03T19:51:24.161Z",
|
|
"dateUpdated": "2026-11-09T13:49:29.531Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"affected": [
|
|
{
|
|
"defaultStatus": "affected",
|
|
"product": "Fabric Composer",
|
|
"vendor": "Hewlett Packard Enterprise (HPE)",
|
|
"versions": [
|
|
{
|
|
"lessThanOrEqual": "7.4.0",
|
|
"status": "affected",
|
|
"version": "7.4.0",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"lessThanOrEqual": "7.3.4",
|
|
"status": "affected",
|
|
"version": "7.0.0",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"type": "reporter",
|
|
"value": "Internal security research (HPE Networking)."
|
|
}
|
|
],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "A race condition vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to corrupt the configuration state of the affected system."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"attackComplexity": "HIGH",
|
|
"attackVector": "NETWORK",
|
|
"baseScore": 4.2,
|
|
"baseSeverity": "MEDIUM",
|
|
"confidentialityImpact": "NONE",
|
|
"availabilityImpact": "LOW",
|
|
"integrityImpact": "LOW",
|
|
"privilegesRequired": "LOW",
|
|
"scope": "UNCHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
|
|
"version": "3.1"
|
|
},
|
|
"format": "CVSS",
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "GENERAL"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "eb103674-0d28-4225-80f8-39fb86215de0",
|
|
"shortName": "hpe",
|
|
"dateUpdated": "2026-11-03T19:51:24.161Z"
|
|
},
|
|
"references": [
|
|
{
|
|
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US"
|
|
}
|
|
],
|
|
"source": {
|
|
"advisory": "HPESBNW05172",
|
|
"discovery": "INTERNAL"
|
|
},
|
|
"title": "Authenticated Race Condition in API of HPE Networking Fabric Composer",
|
|
"x_generator": {
|
|
"engine": "Vulnogram 0.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"type": "CWE",
|
|
"cweId": "CWE-362",
|
|
"lang": "en",
|
|
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2026-11-09T13:48:36.432478Z",
|
|
"id": "CVE-2026-95772",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-11-09T13:49:29.531Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |