CVE-2021-29206

Published May 25, 2021 CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Description

A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers

affected

Version	Status	Constraints
`Prior to HPE Integrated Lights-Out 4 (iLO 4) version 2.78`	affected	—
`Prior to HPE Integrated Lights-Out 5 (iLO 5) version 2.44`	affected	—
`unspecified`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:hp:integrated_lights-out_4:*:*:*:*:*:*:*:*

cpe:2.3:h:hp:simplivity_380_gen9:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:hp:integrated_lights-out_5:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:hp:proliant_bl460c_gen10_server_blade:-:::::::*
	cpe:2.3:h:hp:proliant_dl120_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_dl160_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_dl180_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_dl20_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_dl325_gen10_plus_server:-:::::::*
	cpe:2.3:h:hp:proliant_dl325_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_dl360_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_dl380_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_dl385_gen10_plus_server:-:::::::*
	cpe:2.3:h:hp:proliant_dl385_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_dl560_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_dl580_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_ml110_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_ml30_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_ml350_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_xl170r_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_xl190r_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_xl230k_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_xl270d_gen10_server:-:::::::*
	cpe:2.3:h:hp:proliant_xl450_gen10_server:-:::::::*
	cpe:2.3:h:hp:simplivity_2600:-:::::::*
	cpe:2.3:h:hp:simplivity_325:-:::::::*
	cpe:2.3:h:hp:simplivity_380_gen10:-:::::::*
	cpe:2.3:h:hp:simplivity_380_gen10_g:-:::::::*
	cpe:2.3:h:hp:simplivity_380_gen10_h:-:::::::*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2021-15845	A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.653% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04134en_us

History

No history.

Subscriptions

Hp Integrated Lights-out 4 Integrated Lights-out 5 Proliant Bl460c Gen10 Server Blade Proliant Dl120 Gen10 Server Proliant Dl160 Gen10 Server Proliant Dl180 Gen10 Server Proliant Dl20 Gen10 Server Proliant Dl325 Gen10 Plus Server Proliant Dl325 Gen10 Server Proliant Dl360 Gen10 Server Proliant Dl380 Gen10 Server Proliant Dl385 Gen10 Plus Server Proliant Dl385 Gen10 Server Proliant Dl560 Gen10 Server Proliant Dl580 Gen10 Server Proliant Ml110 Gen10 Server Proliant Ml30 Gen10 Server Proliant Ml350 Gen10 Server Proliant Xl170r Gen10 Server Proliant Xl190r Gen10 Server Proliant Xl230k Gen10 Server Proliant Xl270d Gen10 Server Proliant Xl450 Gen10 Server Simplivity 2600 Simplivity 325 Simplivity 380 Gen10 Simplivity 380 Gen10 G Simplivity 380 Gen10 H Simplivity 380 Gen9

Weaknesses