CVE-2022-23701
Medium
Description
A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60. This vulnerability could be remotely exploited to allow an attacker to supply invalid input to the iLO 4 webserver, causing it to respond with a redirect to an attacker-controlled domain. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 4 (iLO 4).
SeverityMedium
CVSS5.3
Exploit probability—
ProductHpe Integrated Lights-out
PublishedFeb 24, 2022
First seenFeb 24, 2022
How to fix
Update
- hpe integrated_lights-out2.60 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hpe integrated_lights-out | v < 2.60 | 2.60 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.