Skip to main content

Insight Remote Support CVE-2024-53674

HIGH
XML Injection (aka Blind XPath Injection) (CWE-91)
2024-11-26 security-alert@hpe.com
XXE Insight Remote Support
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Nov 26, 2024 - 22:15 nvd
HIGH 7.5

DescriptionNVD

An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.

AnalysisAI

An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-91. An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. Affected products include: Hpe Insight Remote Support.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Insight Remote Support

View all
CVE-2024-53676 CRITICAL POC
9.8 Nov 27

A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution
CVE-2025-37097 HIGH POC
7.5 Jul 01

A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
CVE-2025-37099 CRITICAL
9.8 Jul 01

A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
CVE-2024-53673 CRITICAL
9.8 Nov 26

A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code
CVE-2025-37098 HIGH
7.5 Jul 01

A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
CVE-2024-53675 HIGH
7.5 Nov 26

An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose in
CVE-2024-11622 HIGH
7.5 Nov 26

An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose in
CVE-2023-30904 MEDIUM
5.5 Jun 16

A security vulnerability in HPE Insight Remote Support may result in the local disclosure of privileged LDAP information

Same weakness CWE-91 – XML Injection (aka Blind XPath Injection)

View all
CVE-2020-0646 CRITICAL POC
9.8
CVE-2023-46214 HIGH POC
8.8
CVE-2023-27253 HIGH POC
8.8
CVE-2013-7429 CRITICAL POC
9.8
CVE-2023-43187 CRITICAL POC
9.8
CVE-2019-17626 CRITICAL POC
9.8
CVE-2019-16941 CRITICAL POC
9.8
CVE-2019-14277 CRITICAL POC
9.8

Same technique XXE

View all
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2013-5014 HIGH POC
7.5
CVE-2015-0923 MEDIUM POC
5.0
CVE-2014-0644 HIGH POC
7.8

Share

CVE-2024-53674 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy