What is CVE-2022-23703?

CVE-2022-23703 is a high-severity vulnerability in HPE Nimbleos. CVSS score: 7.5/10. Published 2022-04-12.

How severe is CVE-2022-23703?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in HPE Nimbleos

CVE-2022-23703

A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Flash Arrays during update. This would potentially allow an attacker to intercept and modify network communication for software updates initiated by the Nimble appliance. The following NimbleOS versions, and all subsequent releases, contain a software fix for this vulnerability: 5.0.10.100, 5.2.1.500, 6.0.0.100

EPSS: 0.008 (51.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Hpe Nimbleos — versions 5.3.1.0
N/a Hpe Nimble Storage Hybrid Flash Arrays; All Secondary Arrays — versions 5.3.1.0 and earlier, 5.2.1.400 and earlier and 5.0.10.0 and earlier

References

security-alert@hpe.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2022-23703?: CVE-2022-23703 is a high-severity vulnerability in HPE Nimbleos. CVSS score: 7.5/10. Published 2022-04-12.
How severe is CVE-2022-23703?: High severity. CVSS v3 base score is 7.5 out of 10.