TI-2019-09002 Aliases CVE-2019-11998 GHSA-5qxm-f688-h9fm

Improper input validation in Hewlett Packard Enterprise (HPE) HPE Superdome Flex Server

LOW 26CWE-20Published 2020-01-16 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

HPE Superdome Flex Server is vulnerable to multiple remote vulnerabilities via improper input validation of administrator commands. This vulnerability could allow an Administrator to bypass security restrictions and access multiple remote vulnerabilities including information disclosure, or denial of service. HPE has provided firmware updates that address the above vulnerabilities for the HPE Superdome Flex Server starting with firmware version v3.20.186 (not available online) and v3.20.206 (available online). Apply v3.20.206 (4 December 2019) or a newer version to resolve this issue. Please visit HPE Support Center https://support.hpe.com/hpesc/public/home to obtain the updated firmware for your product.

Why it matters now

EPSS 0.00755 55th percentileScored 2026-11-07

Fix Fixed HPE Superdome Flex Server (HPE): v3.20.186

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Hewlett Packard Enterprise (HPE)	HPE Superdome Flex Server	before v3.20.186	v3.20.186	Patch available	CNA

HPE Superdome Flex Server VendorHewlett Packard Enterprise (HPE) Affected before v3.20.186 Fixed in v3.20.186 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:hpe:superdome_flex_server_firmware::::::::	before 3.20.186	Vulnerable	Hewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:superdome_flex_server:-:::::::*	not specified by NVD	Running on	Hewlett Packard Enterprise (HPE)

cpe:2.3:o:hpe:superdome_flex_server_firmware:*:*:*:*:*:*:*:* Versions before 3.20.186 Vulnerable ·Hewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:superdome_flex_server:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)

Remediation

Fix · CNA HPE Superdome Flex Server (HPE) Fixed in v3.20.186

Timeline

2026-10-02 Threatist record created from CVE-2019-11998
2026-10-03 Alias added: GHSA-5qxm-f688-h9fm

References

Advisory 1

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03978en_us

TI-2021-08304 A potential security vulnerability has been identified in HPE Superdome Flex server. CVSS 3.1MEDIUM 6.5
TI-2022-07754 A potential security vulnerability has been identified in HPE Superdome Flex and… CVSS 3.1MEDIUM 6.7
TI-2020-05749 Improper input validation in HPE Superdome Flex Server CVSS 3.1MEDIUM 6.7
TI-2022-17670 A potential security vulnerability has been identified in HPE Superdome Flex and… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences