What’s Vulnerable › Vulnerabilities

CVE-2021-26587

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-09-27 · updated 2026-06-17
• Weakness: CWE-79

Description

A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce. The vulnerability could be remotely exploited to cause an elevation of privilege leading to partial impact to confidentiality, availability, and integrity. HPE has made the following software update - HPE StoreOnce 4.3.0, to resolve the vulnerability in HPE StoreOnce.

Affected products

• HPE Storeonce 3620 Firmware: through 4.2.3
• HPE StoreOnce Software: through 4.2.3
• HPE Storeonce 5200 Firmware: through 4.2.3
• HPE Storeonce 5250 Firmware: through 4.2.3
• HPE Storeonce 5650 Firmware: through 4.2.3
• HPE Storeonce Vsa 4Tb Firmware: through 4.2.3

References

• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04176en_us
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04176en_us

Get alerted when CVE-2021-26587 or the next vulnerability affects your stack