CVE-2023-28083 | ByteOS Network

Vulnerability Details :

CVE-2023-28083

Assigner-hpe

Assigner Org ID-eb103674-0d28-4225-80f8-39fb86215de0

Published At-20 Mar, 2023 | 12:34

Updated At-26 Feb, 2025 | 19:17

Potential Cross-Site scripting vulnerability in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4).

A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). HPE has provided software updates to resolve this vulnerability in HPE Integrated Lights-Out.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:hpe

Assigner Org ID:eb103674-0d28-4225-80f8-39fb86215de0

Published At:20 Mar, 2023 | 12:34

Updated At:26 Feb, 2025 | 19:17

▼CVE Numbering Authority (CNA)

Potential Cross-Site scripting vulnerability in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4).

A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). HPE has provided software updates to resolve this vulnerability in HPE Integrated Lights-Out.

Affected Products

Vendor

Hewlett Packard Enterprise (HPE)

Product

Integrated Lights-Out

Default Status

affected

Versions

Affected

From Integrated Lights-Out 6 (iLO 6) before 1.20 (1.20)
From Integrated Lights-Out 5 (iLO 5) before 2.78 (2.78)
From Integrated Lights-Out 4 (iLO 4) before 2.82 (2.82)

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	8.3	HIGH	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Version: 3.1

Base score: 8.3

Base severity: HIGH

Vector:

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Impacts

CAPEC ID	Description
CAPEC-63	CAPEC-63 Cross-Site Scripting (XSS)

CAPEC ID: CAPEC-63

Description: CAPEC-63 Cross-Site Scripting (XSS)

References

Hyperlink	Resource
https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04456en_us	N/A

Hyperlink: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04456en_us

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04456en_us	x_transferred

Hyperlink: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04456en_us

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:security-alert@hpe.com

Published At:22 Mar, 2023 | 06:15

Updated At:24 Mar, 2023 | 20:20

A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). HPE has provided software updates to resolve this vulnerability in HPE Integrated Lights-Out.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Secondary	3.1	8.3	HIGH	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Type: Primary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 8.3

Base severity: HIGH

Vector:

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

CPE Matches

>>integrated_lights-out_4>>Versions before 2.82(exclusive)

cpe:2.3:o:hp:integrated_lights-out_4:*:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>apollo_4200_gen9_server>>-

cpe:2.3:h:hpe:apollo_4200_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>apollo_r2000_chassis>>-

cpe:2.3:h:hpe:apollo_r2000_chassis:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_bl420c_gen8_server>>-

cpe:2.3:h:hpe:proliant_bl420c_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_bl460c_gen8_server_blade>>-

cpe:2.3:h:hpe:proliant_bl460c_gen8_server_blade:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_bl460c_gen9_server_blade>>-

cpe:2.3:h:hpe:proliant_bl460c_gen9_server_blade:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_bl465c_gen8_server_blade>>-

cpe:2.3:h:hpe:proliant_bl465c_gen8_server_blade:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_bl660c_gen8_server_blade>>-

cpe:2.3:h:hpe:proliant_bl660c_gen8_server_blade:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_bl660c_gen9_server>>-

cpe:2.3:h:hpe:proliant_bl660c_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl120_gen9_server>>-

cpe:2.3:h:hpe:proliant_dl120_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl160_gen8_server>>-

cpe:2.3:h:hpe:proliant_dl160_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl160_gen9_server>>-

cpe:2.3:h:hpe:proliant_dl160_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl180_gen9_server>>-

cpe:2.3:h:hpe:proliant_dl180_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl20_gen9_server>>-

cpe:2.3:h:hpe:proliant_dl20_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl320e_gen8_server>>-

cpe:2.3:h:hpe:proliant_dl320e_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl320e_gen8_v2_server>>-

cpe:2.3:h:hpe:proliant_dl320e_gen8_v2_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl360_gen9_server>>-

cpe:2.3:h:hpe:proliant_dl360_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl360e_gen8_server>>-

cpe:2.3:h:hpe:proliant_dl360e_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl360p_gen8_server>>-

cpe:2.3:h:hpe:proliant_dl360p_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl380_gen9_server>>-

cpe:2.3:h:hpe:proliant_dl380_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl380e_gen8_server>>-

cpe:2.3:h:hpe:proliant_dl380e_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl380p_gen8_server>>-

cpe:2.3:h:hpe:proliant_dl380p_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl385p_gen8_\(amd\)>>-

cpe:2.3:h:hpe:proliant_dl385p_gen8_\(amd\):-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl560_gen8_server>>-

cpe:2.3:h:hpe:proliant_dl560_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl560_gen9_server>>-

cpe:2.3:h:hpe:proliant_dl560_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl580_gen8_server>>-

cpe:2.3:h:hpe:proliant_dl580_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl580_gen9_server>>-

cpe:2.3:h:hpe:proliant_dl580_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl60_gen9_server>>-

cpe:2.3:h:hpe:proliant_dl60_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_dl80_gen9_server>>-

cpe:2.3:h:hpe:proliant_dl80_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_microserver_gen8>>-

cpe:2.3:h:hpe:proliant_microserver_gen8:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_ml110_gen9_server>>-

cpe:2.3:h:hpe:proliant_ml110_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_ml30_gen9_server>>-

cpe:2.3:h:hpe:proliant_ml30_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_ml310e_gen8_server>>-

cpe:2.3:h:hpe:proliant_ml310e_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_ml310e_gen8_v2_server>>-

cpe:2.3:h:hpe:proliant_ml310e_gen8_v2_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_ml350_gen9_server>>-

cpe:2.3:h:hpe:proliant_ml350_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_ml350e_gen8_server>>-

cpe:2.3:h:hpe:proliant_ml350e_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_ml350e_gen8_v2_server>>-

cpe:2.3:h:hpe:proliant_ml350e_gen8_v2_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_ml350p_gen8_server>>-

cpe:2.3:h:hpe:proliant_ml350p_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_sl210t_gen8_server>>-

cpe:2.3:h:hpe:proliant_sl210t_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_sl230s_gen8_server>>-

cpe:2.3:h:hpe:proliant_sl230s_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_sl250s_gen8_server>>-

cpe:2.3:h:hpe:proliant_sl250s_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_sl270s_gen8_se_server>>-

cpe:2.3:h:hpe:proliant_sl270s_gen8_se_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_sl270s_gen8_server>>-

cpe:2.3:h:hpe:proliant_sl270s_gen8_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_ws460c_gen8_graphics_server_blade>>-

cpe:2.3:h:hpe:proliant_ws460c_gen8_graphics_server_blade:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_ws460c_gen9_graphics_server_blade>>-

cpe:2.3:h:hpe:proliant_ws460c_gen9_graphics_server_blade:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_xl170r_gen9_server>>-

cpe:2.3:h:hpe:proliant_xl170r_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_xl190r_gen9_server>>-

cpe:2.3:h:hpe:proliant_xl190r_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_xl220a_gen8_v2_server>>-

cpe:2.3:h:hpe:proliant_xl220a_gen8_v2_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_xl230a_gen9_server>>-

cpe:2.3:h:hpe:proliant_xl230a_gen9_server:-:*:*:*:*:*:*:*

Hewlett Packard Enterprise (HPE)

>>proliant_xl230b_gen9_server>>-

cpe:2.3:h:hpe:proliant_xl230b_gen9_server:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov
CWE-79	Secondary	security-alert@hpe.com

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-79

Type: Secondary

Source: security-alert@hpe.com

References

Hyperlink	Source	Resource
https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04456en_us	security-alert@hpe.com	Vendor Advisory

Hyperlink: https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04456en_us

Source: security-alert@hpe.com

Resource:

Vendor Advisory