Hpe Oneview
Monthly
Cross-site scripting (CWE-79) in HPE OneView (CVSS 3.1 base 8.2) lets remote attackers with no authentication of their own plant script that executes inside the browser session of a logged-in OneView user, which the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) indicates can escalate into session hijacking, theft of data visible to that user, or other unauthorized actions performed with the victim's privileges. Because the vector requires user interaction (UI:R), successful exploitation depends on a legitimate - typically administrative - user viewing or interacting with attacker-controlled content, making it opportunistic or targeted rather than fully automatable; the scope-changed, high-confidentiality impact means the consequences are bounded by the victim's session privilege. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation; the CPE entry uses a wildcard version, so all OneView versions should be treated as potentially affected until HPE confirms fixed builds.
Cross-site scripting (CWE-79) in the HPE OneView web management interface allows an unauthenticated remote attacker to have attacker-controlled script execute inside a logged-in HPE OneView administrator's browser session, which HPE describes as enabling remote session hijacking or other unauthorized actions. Successful exploitation requires the victim - an authenticated OneView administrator - to load the crafted content (CVSS UI:R), so the flaw cannot be triggered unattended against a default deployment; the attacker needs no credentials (PR:N) and can deliver the payload over the network (AV:N). With a vendor-assigned CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), the scope-change and high-confidentiality metrics reflect that a hijacked administrator session can expose data well beyond the vulnerable page itself; no public exploit or proof-of-concept was identified at time of analysis and there is no CISA KEV listing.
Open redirect in the HPE OneView management web interface allows a remote, unauthenticated attacker to craft a URL that, once clicked by a victim, sends that victim's browser to an arbitrary attacker-chosen destination. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) and does not compromise the OneView server itself; the practical risk is phishing and credential-theft staging that borrows the trust of a legitimate OneView hostname. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the overall risk is assessed as low, with the user-interaction prerequisite the primary limiting factor.
Cross-site scripting (CWE-79) in HPE OneView (CVSS 3.1 base 8.2) lets remote attackers with no authentication of their own plant script that executes inside the browser session of a logged-in OneView user, which the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) indicates can escalate into session hijacking, theft of data visible to that user, or other unauthorized actions performed with the victim's privileges. Because the vector requires user interaction (UI:R), successful exploitation depends on a legitimate - typically administrative - user viewing or interacting with attacker-controlled content, making it opportunistic or targeted rather than fully automatable; the scope-changed, high-confidentiality impact means the consequences are bounded by the victim's session privilege. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation; the CPE entry uses a wildcard version, so all OneView versions should be treated as potentially affected until HPE confirms fixed builds.
Cross-site scripting (CWE-79) in the HPE OneView web management interface allows an unauthenticated remote attacker to have attacker-controlled script execute inside a logged-in HPE OneView administrator's browser session, which HPE describes as enabling remote session hijacking or other unauthorized actions. Successful exploitation requires the victim - an authenticated OneView administrator - to load the crafted content (CVSS UI:R), so the flaw cannot be triggered unattended against a default deployment; the attacker needs no credentials (PR:N) and can deliver the payload over the network (AV:N). With a vendor-assigned CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), the scope-change and high-confidentiality metrics reflect that a hijacked administrator session can expose data well beyond the vulnerable page itself; no public exploit or proof-of-concept was identified at time of analysis and there is no CISA KEV listing.
Open redirect in the HPE OneView management web interface allows a remote, unauthenticated attacker to craft a URL that, once clicked by a victim, sends that victim's browser to an arbitrary attacker-chosen destination. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) and does not compromise the OneView server itself; the practical risk is phishing and credential-theft staging that borrows the trust of a legitimate OneView hostname. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the overall risk is assessed as low, with the user-interaction prerequisite the primary limiting factor.