« Volver al listado

CVE-2022-28624

Estado: ModificadaMedia (4.8)—

A potential security vulnerability has been identified in certain HPE FlexNetwork and FlexFabric switch products. The vulnerability could be remotely exploited to allow cross site scripting (XSS). HPE has made the following software updates to resolve the vulnerability. HPE FlexNetwork 5130EL_7.10.R3507P02 and HPE FlexFabric 5945_7.10.R6635.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

HPE — Flexfabric 5945 FirmwareHPE — Flexnetwork 5130 EI Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-28624",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "security-alert@hpe.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "HPE FlexNetwork 5130 EI Switch Series; HPE FlexFabric 5945 Switch Series",
          "versions": [
            {
              "status": "affected",
              "version": "Prior to Version 5130EL_7.10.R3507P02 and Prior to Version 5945_7.10.R6635"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-07-08T13:15:08.193",
  "references": [
    {
      "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04265en_us",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-alert@hpe.com"
    },
    {
      "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04265en_us",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A potential security vulnerability has been identified in certain HPE FlexNetwork and FlexFabric switch products. The vulnerability could be remotely exploited to allow cross site scripting (XSS). HPE has made the following software updates to resolve the vulnerability. HPE FlexNetwork 5130EL_7.10.R3507P02 and HPE FlexFabric 5945_7.10.R6635."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una posible vulnerabilidad de seguridad en algunos productos switch HPE FlexNetwork y FlexFabric. La vulnerabilidad podría ser explotada remotamente para permitir un ataque de tipo cross site scripting (XSS). HPE ha realizado las siguientes actualizaciones de software para resolver la vulnerabilidad. HPE FlexNetwork versión 5130EL_7.10.R3507P02 y HPE FlexFabric versión 5945_7.10.R6635"
    }
  ],
  "lastModified": "2026-06-17T04:38:43.780",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:hpe:flexnetwork_5130_ei_firmware:7.10.r3507p02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54654BA2-53DE-4CA9-8B59-3732ADB75663"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:hpe:flexnetwork_5130_ei:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "40CC9302-1EDD-4348-A341-4BEB6A0D6AFD"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:hpe:flexfabric_5945_firmware:7.10.r6635:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C961B785-2163-456B-9367-50EED04B8627"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:hpe:flexfabric_5945:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D1FE27AB-09AB-4287-9CFE-C490200454F5"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security-alert@hpe.com"
}