PT-2022-4184 · Hewlett Packard · Hpe Oneview

Nikita Abramov · CVE-2022-23699 · Published 2022-01-17 · Updated 2023-08-08

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE OneView versions prior to 6.6

Description A local authentication restriction bypass issue was found, related to weaknesses in the authentication procedure. This could allow an attacker to bypass existing security restrictions. HPE has provided a software update to resolve this issue.

Recommendations For versions prior to 6.6, update to version 6.6 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of HPE OneView until the update can be applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2022-05032

CVE-2022-23699

Affected Products

Hpe Oneview

References · 10

• https://bdu.fstec.ru/vul/2022-05032 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23699 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23699 · Vendor Advisory
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn04252en_us · Vendor Advisory
• https://t.me/ptswarm/120 · Telegram Post
• https://t.me/cibsecurity/40138 · Telegram Post
• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-hpesbgn04252en_us · Note
• https://t.me/cvenotify/28827 · Telegram Post
• https://t.me/ckure/11177 · Telegram Post
• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-hpesbgn04252en_us · Note