What’s Vulnerable › Vulnerabilities

CVE-2023-28083: Potential Cross-Site scripting vulnerability in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4).

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-03-22 · updated 2026-06-17
• Weakness: CWE-79

Description

A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). HPE has provided software updates to resolve this vulnerability in HPE Integrated Lights-Out.

Affected products

• Hewlett Packard Enterprise Integrated Lights-Out 4: before 2.82 — fixed in 2.82
• HP Integrated Lights-Out 5: before 2.78 — fixed in 2.78
• HP Integrated Lights-Out 6: before 1.20 — fixed in 1.20

How to fix

Upgrade to a fixed version: Hewlett Packard Enterprise Integrated Lights-Out 4 2.82; HP Integrated Lights-Out 5 2.78; HP Integrated Lights-Out 6 1.20. Check the vendor advisory for mitigations.

References

• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04456en_us
• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04456en_us

Get alerted when CVE-2023-28083 or the next vulnerability affects your stack