CVE-2022-23705 File upload in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays

High 7.5 Published 9 May 2022 Updated 3 Aug 2024

Attackers can upload unauthorized update binaries to HPE Nimble Storage arrays, potentially compromising data integrity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-23705?

CVE-2022-23705 is a high-severity vulnerability in HPE Nimble Storage Hybrid Flash Arrays; Nimble Storage All Flash Arrays; Nimble Storage Secondary Flash Arrays, published on 9 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays, and HPE Nimble Storage Secondary Flash Arrays which could potentially allow the upload, but not execution, of unauthorized update binaries to the array. HPE has made the following software updates to resolve the vulnerability in HPE Nimble Storage: 5.0.10.100 or later, 5.2.1.0 or later, 6.0.0.100 or later.

Which versions are affected by CVE-2022-23705?

It affects 1 product.

Products include Hpe Nimbleos.

How do I fix CVE-2022-23705?

No fix has been published for CVE-2022-23705 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-23705 being exploited?

There is no known exploitation of CVE-2022-23705 in the wild and no public exploit code.

Sources

Also known as GHSA-3jm5-qqg2-4jf9.