CVE-2018-7119

Severity: high (CVSS 7.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-10 · updated 2026-06-17

Description

A Local Disclosure of Sensitive Information vulnerability was identified in HPE NonStop Safeguard earlier than version SPR T9750L01^AIC or T9750H05^AIH, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND; all versions on H-series. STDSEC-STANDARD SECURITY PROD All prior versions before T6533L01^ADU or T6533H05^ADW, and later versions when the PASSWORD-PROMPT configuration attribute is not set to BLIND and all versions on H-series . Note that some commands in NonStop Safeguard and NonStop Standard Security software require username and password to be passed as command line parameters, which may lead to a local disclosure of the credentials.

Affected products

HP Nonstop Safeguard H Series: all versions
HP Nonstop Safeguard J Series: before t9750h05\^aih — fixed in t9750h05\^aih
HP Nonstop Safeguard L Series: before t9750l01\^aic — fixed in t9750l01\^aic
HP Nonstop Standard Security H Series: all versions
HP Nonstop Standard Security J Series: through t6533h05\^adw
HP Nonstop Standard Security L Series: before t6533l01\^adu — fixed in t6533l01\^adu

How to fix

Upgrade to a fixed version: HP Nonstop Safeguard J Series t9750h05\^aih; HP Nonstop Safeguard L Series t9750l01\^aic; HP Nonstop Standard Security L Series t6533l01\^adu. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-7119 or the next vulnerability affects your stack