CVE-2023-28092 - OpenCVE

A potential security vulnerability has been identified in HPE ProLiant RL300 Gen11 Server. The vulnerability could result in the system being vulnerable to exploits by attackers with physical access inside the server chassis.

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Hp	Proliant Rl300 Firmware Proliant Rl300 Integrated Lights-out Firmware Integrated Lights-out

Configuration 1 [-]

AND

cpe:2.3:o:hp:integrated_lights-out_firmware:1.05:*:*:*:*:*:*:*

cpe:2.3:h:hp:integrated_lights-out:6:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:hp:proliant_rl300_firmware:1.12:*:*:*:*:*:*:*

cpe:2.3:h:hp:proliant_rl300:gen_11:*:*:*:*:*:*:*

References

Link	Resource
https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04472en_us	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: hpe

Published: 2023-05-01T14:10:19.471Z

Updated: 2023-05-01T14:46:03.772Z

Reserved: 2023-03-10T14:47:44.212Z

Link: CVE-2023-28092

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-05-01T15:15:09.357

Modified: 2023-05-10T13:51:15.777

Link: CVE-2023-28092

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:hp:integrated_lights-out_firmware:1.05:*:*:*:*:*:*:*", "matchCriteriaId": "669BABDD-65EC-44AB-833C-AFF4224EB356", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:hp:integrated_lights-out:6:*:*:*:*:*:*:*", "matchCriteriaId": "F211ABF9-9617-43CF-9DC5-E46CB0518B7E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:hp:proliant_rl300_firmware:1.12:*:*:*:*:*:*:*", "matchCriteriaId": "0CCE84C1-7EF8-4460-8417-A1A769933E41", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:hp:proliant_rl300:gen_11:*:*:*:*:*:*:*", "matchCriteriaId": "4E35165C-B5B8-47E2-829C-AE0187F3BBE2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A potential security vulnerability has been identified in HPE ProLiant RL300 Gen11 Server. The vulnerability could result in the system being vulnerable to exploits by attackers with physical access inside the server chassis.\n\n"}], "id": "CVE-2023-28092", "lastModified": "2023-05-10T13:51:15.777", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.3, "impactScore": 5.3, "source": "security-alert@hpe.com", "type": "Secondary"}]}, "published": "2023-05-01T15:15:09.357", "references": [{"source": "security-alert@hpe.com", "tags": ["Vendor Advisory"], "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04472en_us"}], "sourceIdentifier": "security-alert@hpe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}