Exposed SAN Switch Administrative Credentials in HPE OneView Appliance
CVE-2023-28088

7.8HIGH

Key Information:

Vendor

HP (HP)

Status
HP Oneview
Vendor
CVE Published:
25 April 2023

What is CVE-2023-28088?

A misconfiguration in the HPE OneView appliance can lead to the exposure of administrative credentials used for SAN switches. This vulnerability arises from improper handling of appliance dumps, which may inadvertently reveal sensitive credentials, potentially allowing unauthorized users to gain control over SAN infrastructure. Organizations using HPE OneView should review their configurations and secure access to sensitive dumps to mitigate risks associated with unauthorized access.

Affected Version(s)

HPE OneView 0 < 8.2

HPE OneView 0 < 6.60.04

References

https://support.hpe.com/hpesc/public/docDisplay?docLocale...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-28088 : Exposed SAN Switch Administrative Credentials in HPE OneView Appliance