High 1 exploited CVE WID-SEC-2024-0186 4 CVEs

HPE OneView: Mehrere Schwachstellen

Published Jan 23, 2024 · Updated Jan 23, 2024 · de-DE

Vendor: HPE Product: OneView < 8.70

Summary

Ein Angreifer kann mehrere Schwachstellen in HPE OneView ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, um seine Privilegien zu erweitern oder einen Denial-of-Service-Zustand zu verursachen.

Product

HPE OneView bietet softwaredefinierte Analysen und eine einheitliche API für den Aufbau und die Verwaltung der IT-Infrastruktur.

Vulnerabilities 4

Critical 9.0

CVE-2021-40438 Exploited · Ransomware Public exploit Scanner template EPSS 100%

mod_proxy SSRF

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine

Sep 16, 2021
KEV Dec 1, 2021
High 7.8

CVE-2023-50274

HPE OneView may allow command injection with local privilege escalation.

Hewlett Packard Enterprise HPE OneView

Jan 23, 2024
High 7.5

CVE-2023-50275

HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.

Hewlett Packard Enterprise HPE OneView

Jan 23, 2024
Medium 5.5

CVE-2023-6573

HPE OneView may have a missing passphrase during restore.

Hewlett Packard Enterprise HPE OneView

Jan 23, 2024

Revision history

2024-01-23 #1
Initiale Fassung

References

HPE Security Bulletin vom 2024-01-23
https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us
GitHub Advisory Database vom 2024-01-23
https://github.com/advisories/GHSA-hc66-p838-6xfp
GitHub Advisory Database vom 2024-01-23
https://github.com/advisories/GHSA-xr6f-9r29-5gq3
GitHub Advisory Database vom 2024-01-23
https://github.com/advisories/GHSA-xw8x-r2rg-vmq9