Medium severity6.5NVD Advisory· Published Sep 27, 2021· Updated Jun 17, 2026

CVE-2021-26587

Description

A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce. The vulnerability could be remotely exploited to cause an elevation of privilege leading to partial impact to confidentiality, availability, and integrity. HPE has made the following software update - HPE StoreOnce 4.3.0, to resolve the vulnerability in HPE StoreOnce.

Affected products

HPE/Storeonce 5200 Firmware
cpe:2.3:o:hpe:storeonce_5200_firmware:*:*:*:*:*:*:*:*
Range: <=4.2.3
HPE/Storeonce 5650 Firmware
cpe:2.3:o:hpe:storeonce_5650_firmware:*:*:*:*:*:*:*:*
Range: <=4.2.3
HPE/Storeonce 5250 Firmware
cpe:2.3:o:hpe:storeonce_5250_firmware:*:*:*:*:*:*:*:*
Range: <=4.2.3
HPE/Storeonce 3640 Firmware
cpe:2.3:o:hpe:storeonce_3640_firmware:*:*:*:*:*:*:*:*
Range: <=4.2.3
HPE/Storeonce 3620 Firmware
cpe:2.3:o:hpe:storeonce_3620_firmware:*:*:*:*:*:*:*:*
Range: <=4.2.3
HPE/Storeonce Vsa 4tb Firmware
cpe:2.3:o:hpe:storeonce_vsa_4tb_firmware:*:*:*:*:*:*:*:*
Range: <=4.2.3
HPE/StoreOnce Softwarellm-create
Range: before 4.3.0

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2021-26587

Description

Affected products

Patches

Vulnerability mechanics

References

News mentions