CVE-2019-5401

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016. The attack exploits an xss injection by setting the attack vector in one of the switch persistent configuration fields (management URL, location, contact). But admin privileges are required to configure these fields thereby reducing the likelihood of exploit. HPE Aruba has provided firmware updates to resolve the vulnerability in HP 2910-48G al Switch. Please update to W.15.14.0017.

Metrics

CVSS 3.0 4.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 1, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-54029.4A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5 CVE-2019-54034.8A remote multiple cross-site scripting vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): pri CVE-2019-54048.8A remote script injection vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1 CVE-2019-54057.3A remote authorization bypass vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5 CVE-2019-54067.2A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3.5.0.1.CVE-2019-54076.3A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s): prior to 3 CVE-2019-54086.5Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage syste CVE-2019-54139.8An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.CVE-2019-54148.1If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of th CVE-2019-54157.5A bug in handling the ignore files and directories feature in serve 6.5.3 allows an attacker to read a file or list the directory that the v CVE-2019-54167.5A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the rem CVE-2019-54177.5A path traversal vulnerability in serve npm package version 7.0.1 allows the attackers to read content of arbitrary files on the remote serv