Skip to main content

Oneview CVE-2023-28084

MEDIUM
Insufficiently Protected Credentials (CWE-522)
2023-04-25 security-alert@hpe.com
Information Disclosure Oneview Oneview Global Dashboard
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Apr 25, 2023 - 20:15 nvd
MEDIUM 5.5

DescriptionNVD

HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens

AnalysisAI

HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Insufficiently Protected Credentials (CWE-522), which allows attackers to obtain user credentials due to weak protection mechanisms. HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens Affected products include: Hp Oneview, Hpe Oneview Global Dashboard.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Hash passwords with strong algorithms (bcrypt, argon2), encrypt credentials in transit and at rest, never log credentials.

More in Oneview

View all
CVE-2023-30912 CRITICAL
9.8 Oct 25

A remote code execution issue exists in HPE OneView. Rated critical severity (CVSS 9.8), this vulnerability is remotely

CVE-2023-30909 CRITICAL
9.8 Sep 14

A remote authentication bypass issue exists in some OneView APIs. Rated critical severity (CVSS 9.8), this vulnerability
CVE-2023-30908 CRITICAL
9.8 Sep 07

A remote authentication bypass issue exists in a OneView API. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2022-28616 CRITICAL
9.8 May 17

A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. Rated

CVE-2022-28617 CRITICAL
9.8 May 17

A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0. Rated critic
CVE-2020-7198 HIGH
8.8 Nov 06

There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synerg
CVE-2023-28088 HIGH
7.8 Apr 25

An HPE OneView appliance dump may expose SAN switch administrative credentials. Rated high severity (CVSS 7.8), this vul
CVE-2022-23699 HIGH
7.8 Apr 04

A local authentication restriction bypass vulnerability was discovered in HPE OneView version(s): Prior to 6.6. Rated hi
CVE-2022-23698 HIGH
7.5 Apr 04

A remote unauthenticated disclosure of information vulnerability was discovered in HPE OneView version(s): Prior to 6.6.
CVE-2023-28089 HIGH
7.1 Apr 25

An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules. Rated high severity (CVSS 7.1),
CVE-2014-2602 MEDIUM
6.5 May 08

Unspecified vulnerability in HP OneView 1.0 and 1.01 allows remote authenticated users to gain privileges via unknown ve
CVE-2022-23706 MEDIUM
6.1 May 17

A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. Rated medium s

Same weakness CWE-522 – Insufficiently Protected Credentials

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2024-44000 CRITICAL POC
9.8
CVE-2023-6421 HIGH POC
7.5
CVE-2017-8225 CRITICAL POC
9.8
CVE-2025-25570 CRITICAL POC
9.8
CVE-2017-17106 CRITICAL POC
9.8
CVE-2017-8837 CRITICAL POC
9.8
CVE-2017-3192 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-28084 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy