Skip to main content

Oneview CVE-2023-30912

CRITICAL
Code Injection (CWE-94)
2023-10-25 security-alert@hpe.com
RCE Code Injection Oneview
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Oct 25, 2023 - 18:17 nvd
CRITICAL 9.8

DescriptionNVD

A remote code execution issue exists in HPE OneView.

AnalysisAI

A remote code execution issue exists in HPE OneView. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. Affected products include: Hpe Oneview.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.

More in Oneview

View all
CVE-2023-30909 CRITICAL
9.8 Sep 14

A remote authentication bypass issue exists in some OneView APIs. Rated critical severity (CVSS 9.8), this vulnerability
CVE-2023-30908 CRITICAL
9.8 Sep 07

A remote authentication bypass issue exists in a OneView API. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2022-28616 CRITICAL
9.8 May 17

A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. Rated

CVE-2022-28617 CRITICAL
9.8 May 17

A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0. Rated critic
CVE-2020-7198 HIGH
8.8 Nov 06

There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synerg
CVE-2023-28088 HIGH
7.8 Apr 25

An HPE OneView appliance dump may expose SAN switch administrative credentials. Rated high severity (CVSS 7.8), this vul
CVE-2022-23699 HIGH
7.8 Apr 04

A local authentication restriction bypass vulnerability was discovered in HPE OneView version(s): Prior to 6.6. Rated hi
CVE-2022-23698 HIGH
7.5 Apr 04

A remote unauthenticated disclosure of information vulnerability was discovered in HPE OneView version(s): Prior to 6.6.
CVE-2023-28089 HIGH
7.1 Apr 25

An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules. Rated high severity (CVSS 7.1),
CVE-2014-2602 MEDIUM
6.5 May 08

Unspecified vulnerability in HP OneView 1.0 and 1.01 allows remote authenticated users to gain privileges via unknown ve
CVE-2022-23706 MEDIUM
6.1 May 17

A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. Rated medium s
CVE-2022-23697 MEDIUM
6.1 Apr 04

A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 6.6. Rated medium s

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8
CVE-2025-32432 CRITICAL POC
10.0

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2023-30912 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy