vulnwire
7.3high

CVE-2024-53675in critical feed

An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certai…

Published 23 mo ago · modified 4 mo ago · JSON

CVSS
7.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
81.0%
percentile 100%
Public exploits
0
none known

An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
23 mo ago

Exploit prediction (EPSS)

81.02% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.17.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA3.17.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Hewlett Packard Enterprise (HPE) HPE Insight Remote Support
  • hpe insight_remote_support

Classification

Weakness
  • CWE-91 XML Injection
  • CWE-611 Improper Restriction of XML External Entity Reference

References

  • support.hpe.com /hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04731en_us

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.