CVE-2024-53674: high-severity vulnerability in Hewlett Packard Enterprise (HPE) HPE Insight…
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
HPE Insight Remote Support has a flaw where attackers can inject malicious XML code to read sensitive files or information from the system. This happens because the software doesn't properly validate XML input from remote users.
XML external entity (XXE) injection vulnerability in HPE Insight Remote Support allows remote, unauthenticated attackers to conduct information disclosure attacks by injecting crafted XML payloads. The vulnerability stems from improper validation of external entity references, enabling file disclosure or other data exfiltration in specific configurations.
In the same product, most dangerous first.