{"id":"CVE-2024-22437","state":"PUBLISHED","title":"HPE MSA SAN Storage VSS Provider and CAPI Proxy Software, Elevation of Privilege","description":"\nA potential security vulnerability has been identified in VSS Provider and CAPI Proxy software for certain HPE MSA storage products. This vulnerability could be exploited to gain elevated privilege on the system.\n\n","publishedAt":"2024-04-15T09:21:40.627Z","updatedAt":"2024-08-01T22:43:34.946Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","source":"hpe"},"assigner":"hpe","products":["Hewlett Packard Enterprise HPE MSA SAN Storage VSS Provider and CAPI Proxy Software"],"affected":[{"vendor":"Hewlett Packard Enterprise","product":"HPE MSA SAN Storage VSS Provider and CAPI Proxy Software","defaultStatus":"unaffected","versions":[{"version":"N/A","status":"affected","lessThan":"4.1.3.83","versionType":"custom"}],"platforms":["Windows"]}],"references":["https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbst04630en_us"],"weaknesses":["CWE-428"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/22xxx/CVE-2024-22437.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-22437","state":"PUBLISHED","datePublished":"2024-04-15T09:21:40.627Z","dateUpdated":"2024-08-01T22:43:34.946Z","assignerShortName":"hpe","assignerOrgId":"eb103674-0d28-4225-80f8-39fb86215de0","dateReserved":"2024-01-10T15:24:39.966Z"},"containers":{"cna":{"title":"HPE MSA SAN Storage VSS Provider and CAPI Proxy Software, Elevation of Privilege","descriptions":[{"lang":"en","value":"\nA potential security vulnerability has been identified in VSS Provider and CAPI Proxy software for certain HPE MSA storage products. This vulnerability could be exploited to gain elevated privilege on the system.\n\n"}],"affected":[{"vendor":"Hewlett Packard Enterprise","product":"HPE MSA SAN Storage VSS Provider and CAPI Proxy Software","defaultStatus":"unaffected","versions":[{"version":"N/A","status":"affected","lessThan":"4.1.3.83","versionType":"custom"}],"platforms":["Windows"]}],"references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbst04630en_us"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-428","description":"CWE-428 Unquoted Search Path or Element","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"hpe","orgId":"eb103674-0d28-4225-80f8-39fb86215de0","dateUpdated":"2024-04-15T09:21:40.627Z"},"credits":[{"lang":"en","type":"reporter","value":"R Cooper of Environtec Limited"}],"datePublic":"2024-04-02T09:13:00.000Z","impacts":[{"capecId":"CAPEC-233","descriptions":[{"lang":"en","value":"CAPEC-233 Privilege Escalation"}]}],"source":{"advisory":"HPESBST04630","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-04-15T13:13:01.628436Z","id":"CVE-2024-22437","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-25T15:51:08.406Z"}},{"title":"CVE Program Container","references":[{"url":"https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbst04630en_us","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T22:43:34.946Z"}}]}}}