HP MSA 2060 Vulnerability Assessment

[socr]

Hi Admin

We have one "Vulnerability Assessment Report" about HP MSA 2060 at controller B
JQuery 1.2 < 3.5.0 Multiple XSS
JQuery Detection
jQuery UI Detection
then "Vulnerability Assessment Report" about HP MSA 2060 at controller A doen't any alert.
I didn't find any setting about web, How can I check ? 

[ArunKKR]

Hi,

I guess the vulnerability assessment is related to CVE-2020-11022.
This has been patched in MSA controller firmware version IN110R001/IN110P001.
IN110P001 is the latest version firmware.

IN110R001 advisory:

https://support.hpe.com/hpesc/public/docDisplay?docId=a00116687en_us&docLocale=en_US

MSA controllers feature JQuery 3.2.1 with the patches to mitigate CVE-2020-11022.

Vulnerability scanner is probably not taking into consideration that the issue has been patched and just say "you don't have 3.5.0 therefore you are open to this CVE".

[ArunKKR]

Hi,

We would like to know if the information shared addressed your query.
Request you to please respond with a Yes/No
You may also click on "Accept as a Solution" button if the issue is resolved.

[imranmohdkhan]

it same for CVE-2020-11022 and cve-2020-11023,  IN210R004 is running on the same patch.

Nessus is reporting that th e version of JQuery hosted on the remote web server (web UI of the SAN) is greater than or equal to 1.2 and prior to 3.5.0. It is, therefore, affected by multiple cross site scripting vulnerabilities. Recommendation is to upgrade to version 3.5.0. Please refer to CVE-2020-11022 and CVE-2020-11023.

Can this be ignored or there is a workaround ?

[Sunitha_Mod]

Hello @imranmohdkhan,

Thank you for writing to us.

You might want to consider creating a new topic by utilizing the "New Discussion" button, as this will not only enhance visibility compared to the old topic but also boost your chances of receiving responses from experts.