CVE-2023-50275 Auth bypass in HPE OneView
Attackers can bypass clusterService authentication in HPE OneView, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-50275?
CVE-2023-50275 is a high-severity authentication bypass vulnerability in Hewlett Packard Enterprise HPE OneView, published on 23 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.
Weakness: CWE-287
Which versions are affected by CVE-2023-50275?
It affects 1 product.
Products include Hp Oneview.
How do I fix CVE-2023-50275?
No fix has been published for CVE-2023-50275 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-50275 being exploited?
There is no known exploitation of CVE-2023-50275 in the wild and no public exploit code.
Other vulnerabilities in Hewlett Packard Enterprise HPE OneView
- CVE-2023-30909 Auth bypass in HPE OneView
- CVE-2023-30908 Auth bypass in HPE OneView
- CVE-2022-28616 Server-side request forgery in HPE OneView
- CVE-2022-28617 Security feature bypass in HPE OneView
- CVE-2020-7198 There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer.
Sources
Also known as GHSA-hc66-p838-6xfp.