1. Home
  2. CVE Database
  3. CVE-2022-28638
HIGH · 7.8

CVE-2022-28638

An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability we...

Vulnerability Description

An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
HpeIntegrated Lights-Out 5 Firmware< 2.72
HpApollo 4200 Gen10 Server-
HpApollo 4500-
HpApollo R2000 Chassis-
HpeApollo 2000 Gen10 Plus System-
HpeApollo 4200 Gen10 Plus System-
HpeApollo 4510 Gen10 System-
HpeApollo 6500 Gen10 Plus-
HpeApollo N2600 Gen10 Plus-
HpeApollo N2800 Gen10 Plus-
HpeApollo R2600 Gen10-
HpeApollo R2800 Gen10-
HpeEdgeline E920 Server Blade-
HpeEdgeline E920D Server Blade-
HpeEdgeline E920T Server Blade-
HpeIntegrated Lights-Out 5-
HpeProliant Bl460C Gen10 Server Blade-
HpeProliant Dl110 Gen10 Plus Telco Server-
HpeProliant Dl160 Gen10 Server-
HpeProliant Dl180 Gen10 Server-

Related Weaknesses (CWE)

CWE-200

References

FAQ

What is CVE-2022-28638?

CVE-2022-28638 is a vulnerability with a CVSS score of 7.8 (HIGH). An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability we...

How severe is CVE-2022-28638?

CVE-2022-28638 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-28638?

Check the references section above for vendor advisories and patch information. Affected products include: Hpe Integrated Lights-Out 5 Firmware, Hp Apollo 4200 Gen10 Server, Hp Apollo 4500, Hp Apollo R2000 Chassis, Hpe Apollo 2000 Gen10 Plus System.