CVE-2019-11991

CRITICAL

HPE has identified a vulnerability in HPE 3PAR Service Processor (SP) version 4.1 through 4.4. HPE 3PAR Service Processor (SP) version 4.1 through 4.4 has a remote information disclosure vulnerability which can allow for the disruption of the confidentiality, integrity and availability of the Service Processor and any managed 3PAR arrays.

Published: Jul 9, 2019 Modified: Jun 17, 2026

CWE-200

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (1)

Vendor	Product	Version
hp	3par_service_processor_firmware	* ≥ 4.1

GitHub Security Advisory GHSA-mg57-m54h-vxc8

HPE has identified a vulnerability in HPE 3PAR Service Processor (SP) version 4.1 through 4.4....

References (2)

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03918en_us Vendor Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03918en_us Vendor Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 4.70%

Top 9% most likely to be exploited

Threat Score 40.6 / 100

Data Sources

NVD EPSS GitHub