CVE-2023-28083
Potential Cross-Site scripting vulnerability in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4).
MEDIUM
5.4
CVSS Score
Published: March 20, 2023 at 12:34 PM UTC
Updated: June 17, 2026 at 05:46 AM UTC
163 products affected across 2 vendorsIntegrated Lights Out 4Integrated Lights Out 5Integrated Lights Out 6
Using Integrated Lights-Out by HPE?
Get instant alerts when new vulnerabilities affect Integrated Lights-Out - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.4
Exploit prediction
EPSS 0.4%
SSVC
No known exploit
Description
A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). HPE has provided software updates to resolve this vulnerability in HPE Integrated Lights-Out.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 2.82
Affected range stops below 2.82, so it looks safe — our inference, not a vendor statement
hpe-apollo-4200-gen9-server (environment) · hpe-apollo-r2000-chassis (environment) · hpe-proliant-bl420c-gen8-server (environment) · hpe-proliant-bl460c-gen8-server-blade (environment) · hpe-proliant-bl460c-gen9-server-blade (environment) · hpe-proliant-bl465c-gen8-server-blade (environment) · hpe-proliant-bl660c-gen8-server-blade (environment) · hpe-proliant-bl660c-gen9-server (environment) · hpe-proliant-dl120-gen9-server (environment) · hpe-proliant-dl160-gen8-server (environment) · hpe-proliant-dl160-gen9-server (environment) · hpe-proliant-dl180-gen9-server (environment) · hpe-proliant-dl20-gen9-server (environment) · hpe-proliant-dl320e-gen8-server (environment) · hpe-proliant-dl320e-gen8-v2-server (environment) · hpe-proliant-dl360-gen9-server (environment) · hpe-proliant-dl360e-gen8-server (environment) · hpe-proliant-dl360p-gen8-server (environment) · hpe-proliant-dl380-gen9-server (environment) · hpe-proliant-dl380e-gen8-server (environment) · hpe-proliant-dl380p-gen8-server (environment) · hpe-proliant-dl385p-gen8-amd (environment) · hpe-proliant-dl560-gen8-server (environment) · hpe-proliant-dl560-gen9-server (environment) · hpe-proliant-dl580-gen8-server (environment) · hpe-proliant-dl580-gen9-server (environment) · hpe-proliant-dl60-gen9-server (environment) · hpe-proliant-dl80-gen9-server (environment) · hpe-proliant-microserver-gen8 (environment) · hpe-proliant-ml110-gen9-server (environment) · hpe-proliant-ml30-gen9-server (environment) · hpe-proliant-ml310e-gen8-server (environment) · hpe-proliant-ml310e-gen8-v2-server (environment) · hpe-proliant-ml350-gen9-server (environment) · hpe-proliant-ml350e-gen8-server (environment) · hpe-proliant-ml350e-gen8-v2-server (environment) · hpe-proliant-ml350p-gen8-server (environment) · hpe-proliant-sl210t-gen8-server (environment) · hpe-proliant-sl230s-gen8-server (environment) · hpe-proliant-sl250s-gen8-server (environment) · hpe-proliant-sl270s-gen8-se-server (environment) · hpe-proliant-sl270s-gen8-server (environment) · hpe-proliant-ws460c-gen8-graphics-server-blade (environment) · hpe-proliant-ws460c-gen9-graphics-server-blade (environment) · hpe-proliant-xl170r-gen9-server (environment) · hpe-proliant-xl190r-gen9-server (environment) · hpe-proliant-xl220a-gen8-v2-server (environment) · hpe-proliant-xl230a-gen9-server (environment) · hpe-proliant-xl230b-gen9-server (environment) · hpe-proliant-xl250a-gen9-server (environment) · hpe-proliant-xl270d-gen9-special-server (environment) · hpe-proliant-xl450-gen9-server (environment) · hpe-proliant-xl730f-gen9-server (environment) · hpe-proliant-xl740f-gen9-server (environment) · hpe-proliant-xl750f-gen9-server (environment) · hpe-storeeasy-1430-storage (environment) · hpe-storeeasy-1440-storage (environment) · hpe-storeeasy-1450-storage (environment) · hpe-storeeasy-1530-storage (environment) · hpe-storeeasy-1540-storage (environment) · hpe-storeeasy-1550-storage (environment) · hpe-storeeasy-1630-storage (environment) · hpe-storeeasy-1640-storage (environment) · hpe-storeeasy-1650-expanded-storage (environment) · hpe-storeeasy-1650-storage (environment) · hpe-storeeasy-1830-storage (environment) · hpe-storeeasy-1840-storage (environment) · hpe-storeeasy-1850-storage (environment) · hpe-storeeasy-3830-gateway-storage (environment) · hpe-storeeasy-3830-gateway-storage-blade (environment) · hpe-storeeasy-3840-gateway-storage (environment) · hpe-storeeasy-3840-gateway-storage-blade (environment) · hpe-storeeasy-3850-gateway-single-node-upgrade (environment) · hpe-storeeasy-3850-gateway-storage (environment) · hpe-storeeasy-3850-gateway-storage-blade (environment) · hpe-storevirtual-3000-file-controller (environment) · hpe-synergy-480-gen9-compute-module (environment) · hpe-synergy-620-gen9-compute-module (environment) · hpe-synergy-660-gen9-compute-module (environment) · hpe-synergy-680-gen9-compute-module (environment)
v < 2.78
Affected range stops below 2.78, so it looks safe — our inference, not a vendor statement
hpe-apollo-4200-gen10-plus-system (environment) · hpe-apollo-4200-gen10-server (environment) · hpe-apollo-4510-gen10-system (environment) · hpe-apollo-6500-gen10-plus-system (environment) · hpe-apollo-6500-gen10-system (environment) · hpe-apollo-n2600-gen10-plus (environment) · hpe-apollo-n2800-gen10-plus (environment) · hpe-apollo-r2200-gen10 (environment) · hpe-apollo-r2600-gen10 (environment) · hpe-apollo-r2800-gen10 (environment) · hpe-edgeline-e920-server-blade (environment) · hpe-edgeline-e920d-server-blade (environment) · hpe-edgeline-e920t-server-blade (environment) · hpe-proliant-bl460c-gen10-server-blade (environment) · hpe-proliant-dl120-gen10-server (environment) · hpe-proliant-dl160-gen10-server (environment) · hpe-proliant-dl180-gen10-server (environment) · hpe-proliant-dl20-gen10-plus-server (environment) · hpe-proliant-dl20-gen10-server (environment) · hpe-proliant-dl325-gen10-plus-server (environment) · hpe-proliant-dl325-gen10-server (environment) · hpe-proliant-dl345-gen10-plus-server (environment) · hpe-proliant-dl360-gen10-plus-server (environment) · hpe-proliant-dl360-gen10-server (environment) · hpe-proliant-dl365-gen10-plus-server (environment) · hpe-proliant-dl380-gen10-plus-server (environment) · hpe-proliant-dl380-gen10-server (environment) · hpe-proliant-dl385-gen10-plus-server (environment) · hpe-proliant-dl385-gen10-plus-v2-server (environment) · hpe-proliant-dl385-gen10-server (environment) · hpe-proliant-dl560-gen10-server (environment) · hpe-proliant-dl580-gen10-server (environment) · hpe-proliant-dx170r-gen10-server (environment) · hpe-proliant-dx190r-gen10-server (environment) · hpe-proliant-dx220n-gen10-plus-server (environment) · hpe-proliant-dx325-gen10-plus-v2-server (environment) · hpe-proliant-dx360-gen10-plus-server (environment) · hpe-proliant-dx360-gen10-server (environment) · hpe-proliant-dx380-gen10-plus-server (environment) · hpe-proliant-dx380-gen10-server (environment) · hpe-proliant-dx385-gen10-plus-server (environment) · hpe-proliant-dx385-gen10-plus-v2-server (environment) · hpe-proliant-dx4200-gen10-server (environment) · hpe-proliant-dx560-gen10-server (environment) · hpe-proliant-e910-server-blade (environment) · hpe-proliant-e910t-server-blade (environment) · hpe-proliant-ml110-gen10-server (environment) · hpe-proliant-ml30-gen10-plus-server (environment) · hpe-proliant-ml350-gen10-server (environment) · hpe-proliant-xl170r-gen10-server (environment) · hpe-proliant-xl190r-gen10-server (environment) · hpe-proliant-xl220n-gen10-plus-server (environment) · hpe-proliant-xl225n-gen10-plus-1u-node (environment) · hpe-proliant-xl230k-gen10-server (environment) · hpe-proliant-xl270d-gen10-server (environment) · hpe-proliant-xl290n-gen10-plus-server (environment) · hpe-proliant-xl450-gen10-server (environment) · hpe-proliant-xl645d-gen10-plus-server (environment) · hpe-proliant-xl675d-gen10-plus-server (environment) · hpe-storage-file-controller (environment) · hpe-storage-performance-file-controller (environment) · hpe-storeeasy-1460-storage (environment) · hpe-storeeasy-1560-storage (environment) · hpe-storeeasy-1660-expanded-storage (environment) · hpe-storeeasy-1660-performance-storage (environment) · hpe-storeeasy-1660-storage (environment) · hpe-storeeasy-1860-performance-storage (environment) · hpe-storeeasy-1860-storage (environment) · hpe-synergy-480-gen10-compute-module (environment) · hpe-synergy-480-gen10-plus-compute-module (environment) · hpe-synergy-660-gen10-compute-module (environment)
v < 1.20
Affected range stops below 1.20, so it looks safe — our inference, not a vendor statement
hpe-proliant-dl320-gen11-server (environment) · hpe-proliant-dl325-gen11-server (environment) · hpe-proliant-dl345-gen11-server (environment) · hpe-proliant-dl360-gen11-server (environment) · hpe-proliant-dl365-gen11-server (environment) · hpe-proliant-dl380-gen11-server (environment) · hpe-proliant-dl385-gen11-server (environment) · hpe-proliant-ml350-gen11-server (environment)
Integrated Lights-Out 4 (iLO 4) ≤ v < 2.82Integrated Lights-Out 5 (iLO 5) ≤ v < 2.78Integrated Lights-Out 6 (iLO 6) ≤ v < 1.20Integrated Lights-Out 4 (iLO 4)Integrated Lights-Out 5 (iLO 5)Integrated Lights-Out 6 (iLO 6)
Affected range stops below 1.20, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.78, so it looks safe — our inference, not a vendor statement
Affected range stops below 2.82, so it looks safe — our inference, not a vendor statement
80%
All versions
80%
All versions
80%
All versions
80%
All versions
80%
All versions
80%
All versions
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (1)
SSVC — Action Prioritization
SSVCNo known exploitNot automatableTotal impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality
- LOW
- Integrity
- LOW
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-79
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card