Read the docs
TI-2023-12669 Aliases CVE-2023-28090GHSA-mqq2-gjcf-j3cq

An HPE OneView appliance dump may expose SNMPv3 read credentials

Priority LOW 24CWE-522Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-522.

Summary

An HPE OneView appliance dump may expose SNMPv3 read credentials

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0017 6th percentileScored 2026-11-07
Fix Fixed HPE OneView (Hewlett Packard Enterprise (HPE)): 8.2, 6.60.04 LTS

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hewlett Packard Enterprise (HPE)HPE OneViewbefore 8.2; before 6.60.04 LTS8.2, 6.60.04 LTSPatch availableCNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:hp:oneview:*:*:*:*:lts:*:*:*before 6.60.04VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:oneview:*:*:*:*:*:*:*:*before 8.2VulnerableHewlett Packard Enterprise

Remediation

  • Fix · CNA HPE OneView (Hewlett Packard Enterprise (HPE)) Fixed in 8.2, 6.60.04 LTS

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Hewlett Packard Enterprise (HPE) HPE OneView 6.60.04 LTS, 8.2

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2023-12668 An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect ModulesPriority LOW 32
    • TI-2023-12666 An HPE OneView appliance dump may expose OneView user accountsPriority LOW 24
    • TI-2023-12665 An HPE OneView appliance dump may expose proxy credential settingsPriority LOW 24
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-28090
  2. 2026-10-03 Alias added: GHSA-mqq2-gjcf-j3cq

References

Advisory 1

  • TI-2025-25062 A remote code execution issue exists in HPE OneView. KEVCVSS 3.1CRITICAL 10.0
  • TI-2017-03684 Improper privilege management in Intel Active Mangement Technology, Intel Small Business… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2024-35876 Path traversal in Hewlett Packard Enterprise (HPE) HPE Insight Remote Support CVSS 3.1CRITICAL 9.8
  • TI-2020-05748 A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could… CVSS 3.1CRITICAL 9.8
  • TI-2024-35875 XML injection in Hewlett Packard Enterprise (HPE) HPE Insight Remote Support CVSS 3.1HIGH 7.5
See all 927 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences