Remote DOM XSS and CRLF Injection Vulnerability in HPE iLO and SimpliVity Products
CVE-2021-29209

4.8MEDIUM

Key Information:

Vendor
HP
Status
HPe Integrated Lights-out 4 (ilo 4) For HPe Gen9 Servers; HPe Integrated Lights-out 5 (ilo 5) For HPe Gen10 Servers
Vendor
CVE Published:
25 May 2021

Summary

A remote DOM XSS and CRLF injection vulnerability has been identified in HPE Integrated Lights-Out (iLO) 4 and 5, as well as HPE SimpliVity products. This weakness can allow an attacker to inject malicious scripts or manipulate response headers, potentially compromising the security of systems running affected versions prior to 2.78. Users are advised to update to the latest versions to mitigate the risks associated with these vulnerabilities. For detailed information and remedial measures, refer to HPE's official support documentation.

Affected Version(s)

HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers Prior to HPE Integrated Lights-Out 4 (iLO 4) version 2.78

HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers Prior to HPE Integrated Lights-Out 5 (iLO 5) version 2.44

HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers = unspecified

References

https://support.hpe.com/hpsc/doc/public/display?docLocale...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.