CVE-2022-23703 Other in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays

High 7.5 Published 12 Apr 2022 Updated 3 Aug 2024

Attackers can intercept and modify network traffic during software updates on HPE Nimble Storage arrays, potentially compromising update integrity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-23703?

CVE-2022-23703 is a high-severity vulnerability in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays, published on 12 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Flash Arrays during update. This would potentially allow an attacker to intercept and modify network communication for software updates initiated by the Nimble appliance. The following NimbleOS versions, and all subsequent releases, contain a software fix for this vulnerability: 5.0.10.100, 5.2.1.500, 6.0.0.100

Which versions are affected by CVE-2022-23703?

It affects 1 product.

Products include Hpe Nimbleos.

How do I fix CVE-2022-23703?

No fix has been published for CVE-2022-23703 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-23703 being exploited?

There is no known exploitation of CVE-2022-23703 in the wild and no public exploit code.

Sources

Also known as GHSA-m8jx-j345-h7qc.