Fabric Composerに脆弱性3件、認証なしで管理者権限
Summary
HPE Networking Fabric Composerに、認証なしで管理者権限の取得やコード実行につながる重大な脆弱性3件が公表されました。対象の版を使う組織は、HPEの告知で修正版を確認して更新し、それまで管理用の接続元を絞ってください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
HPE Networking Fabric Composerに、認証なしで管理者権限の取得やコード実行につながる重大な脆弱性3件が公表されました。対象の版を使う組織は、HPEの告知で修正版を確認して更新し、それまで管理用の接続元を絞ってください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | Fabric Composer |
7.4.0 – 7.4.0 7.0.0 – 7.3.4 |
— — |
Original description The description as published by the source.
Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials. Successful exploitation could allow an attacker to gain unauthorized administrative access to the affected system with elevated privileges.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web security-alert@hpe.com
- web nvd.nist.gov
- web github.com