CVE-2022-23701 — Injection in HPE Integrated Lights-out

CWE-74 — Injection3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.3%
top 45.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
HPE Integrated Lights-out
Timeline
PublishedFeb 24
Latest updateFeb 25

Description

A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60. This vulnerability could be remotely exploited to allow an attacker to supply invalid input to the iLO 4 webserver, causing it to respond with a redirect to an attacker-controlled domain. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 4 (iLO 4).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-85g2-88cg-wg49: A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior↗2022-02-25
▶
CVEList
CVE-2022-23701: A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior↗2022-02-24
▶
CVE-2022-23701 — Injection in HPE Integrated Lights-out | cvebase