CVE-2022-37940 Open redirect in HPE FlexFabric 5700 Switch Series
Remote attackers can exploit host header injection to redirect users to malicious URLs on HPE FlexFabric 5700 switches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-37940?
CVE-2022-37940 is a medium-severity vulnerability in Hewlett Packard Enterprise (HPE) HPE FlexFabric 5700 Switch Series, published on 15 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exploited to allow host header injection and URL redirection. HPE has made the following software to resolve the vulnerability in HPE FlexFabric 5700 Switch Series version R2432P61 or later.
Weakness: CWE-601
Which versions are affected by CVE-2022-37940?
It affects 2 products.
Products include Hpe Flexfabric 5700 40xg 2qsfp\+ Firmware, Hpe Flexfabric 5700 48g 4xg 2qsfp\+ Firmware.
How do I fix CVE-2022-37940?
No fix has been published for CVE-2022-37940 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-37940 being exploited?
There is no known exploitation of CVE-2022-37940 in the wild and no public exploit code.
Sources
Also known as GHSA-cgm5-p2xv-fjc2.