CVE-2022-23701 - A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60

Back Back to CVE browser

MEDIUM

A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60

Published Feb 24, 2022

5.3

MEDIUM

CVSS 3.1

EPSS 0.69%

Description

A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60. This vulnerability could be remotely exploited to allow an attacker to supply invalid input to the iLO 4 webserver, causing it to respond with a redirect to an attacker-controlled domain. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 4 (iLO 4).

Affected products

Vendor n/a Product HPE Integrated Lights-Out 4 (iLO 4) Default
n/a
- Version
  Prior to 2.60
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

HPE Integrated Lights-Out 4 (iLO 4)

n/a

Version	Status	Constraints
Prior to 2.60	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-74

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28640
Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04249en_us
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-28640		Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04249en_us		x_refsource_MISCVendor Advisory