HP OneView vulnerabilities

22 CVEs affecting HP OneView, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-6573, published 2024-01-23.

More from HP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-28617, published 2022-05-17. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.
• CVE-2020-7198, published 2020-11-06. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer. HPE has provided updates to Oneview and Synergy Composer: Update to…
• CVE-2014-2602, published 2014-05-08. Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days. Unspecified vulnerability in HP OneView 1.0 and 1.01 allows remote authenticated users to gain privileges via unknown vectors.
• CVE-2023-30909, published 2023-09-14. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. A remote authentication bypass issue exists in some OneView APIs.
• CVE-2022-28616, published 2022-05-17. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.
• CVE-2022-23698, published 2022-04-04. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A remote unauthenticated disclosure of information vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE…
• CVE-2023-30908, published 2023-09-07. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. A remote authentication bypass issue exists in a OneView API.
• CVE-2023-50275, published 2024-01-23. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.
• CVE-2022-23706, published 2022-05-17. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software update to resolve this vulnerability in HPE OneView.
• CVE-2022-23697, published 2022-04-04. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vulnerability in HPE OneView.

Latest

• CVE-2023-6573, published 2024-01-23. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. HPE OneView may have a missing passphrase during restore.
• CVE-2023-50274, published 2024-01-23. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. HPE OneView may allow command injection with local privilege escalation.
• CVE-2023-28084, published 2023-04-25. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens
• CVE-2023-28090, published 2023-04-25. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. An HPE OneView appliance dump may expose SNMPv3 read credentials
• CVE-2023-28089, published 2023-04-25. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules
• CVE-2023-28088, published 2023-04-25. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. An HPE OneView appliance dump may expose SAN switch administrative credentials
• CVE-2023-28087, published 2023-04-25. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. An HPE OneView appliance dump may expose OneView user accounts