Remote XSS Vulnerability in HPE Integrated Lights-Out and SimpliVity Products
CVE-2021-29204

4.8MEDIUM

Key Information:

Vendor
HP
Status
HPe Integrated Lights-out 4 (ilo 4) For HPe Gen9 Servers; HPe Integrated Lights-out 5 (ilo 5) For HPe Gen10 Servers
Vendor
CVE Published:
25 May 2021

Summary

A remote cross-site scripting (XSS) vulnerability has been identified in multiple HPE products, enabling attackers to inject malicious scripts via the web interface. This could allow unauthorized actions to be performed on behalf of users, potentially compromising sensitive information and leading to unauthorized access within the affected systems. The vulnerable versions include HPE Integrated Lights-Out 4 (iLO 4), several models of HPE SimpliVity, and iLO 5 for Gen10 servers, with a recommended update to version 2.78 or higher for resolution. For more details, refer to HPE's support document for guidance on securing your systems.

Affected Version(s)

HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers Prior to HPE Integrated Lights-Out 4 (iLO 4) version 2.78

HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers Prior to HPE Integrated Lights-Out 5 (iLO 5) version 2.44

HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers = unspecified

References

https://support.hpe.com/hpsc/doc/public/display?docLocale...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.