CVE-2023-30909 Auth bypass in HPE OneView
Remote attackers can bypass authentication in HPE OneView APIs, potentially gaining unauthorized access to the management interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-30909?
CVE-2023-30909 is a critical authentication bypass vulnerability in Hewlett Packard Enterprise (HPE) HPE OneView, published on 14 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A remote authentication bypass issue exists in some OneView APIs.
Weakness: CWE-294
Which versions are affected by CVE-2023-30909?
It affects 1 product.
Products include Hp Oneview.
How do I fix CVE-2023-30909?
No fix has been published for CVE-2023-30909 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-30909 being exploited?
There is no known exploitation of CVE-2023-30909 in the wild and no public exploit code.
Other vulnerabilities in Hewlett Packard Enterprise (HPE) HPE OneView
- CVE-2023-30908 Auth bypass in HPE OneView
- CVE-2022-28616 Server-side request forgery in HPE OneView
- CVE-2022-28617 Security feature bypass in HPE OneView
- CVE-2020-7198 There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer.
- CVE-2023-50274 Command injection in HPE OneView
Sources
Also known as GHSA-php2-3gv6-62rw.