CVE-2021-26587: hpe storeonce_3620_firmware Cross-site Scripting
Vulnerability summary
CVE-2021-26587 is a medium (CVSS 6.5) Cross-site Scripting vulnerability in hpe storeonce_3620_firmware. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.3% of scored vulnerabilities.
Timeline
- 27-09-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce. The vulnerability could be remotely exploited to cause an elevation of privilege leading to partial impact to confidentiality, availability, and integrity. HPE has made the following software update - HPE StoreOnce 4.3.0, to resolve the vulnerability in HPE StoreOnce.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.50%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
0.00 pp
From 0.50% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Hpe6 products
- storeonce_3620_firmware≤ 4.2.3
- storeonce_3640_firmware≤ 4.2.3
- storeonce_5200_firmware≤ 4.2.3
- storeonce_5250_firmware≤ 4.2.3
- storeonce_5650_firmware≤ 4.2.3
1 vendor · 6 products
References
1 links- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04176en_usX Refsource MISCVendor Advisory