Internal Security

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A stored cross-site scripting (XSS) issue exists in the web-based management interface. This allows an authenticated user with low privilege operator permissions to inject malicious scripts that are then executed in the browser of an administrative user. XSS is a type of attack where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** An unauthenticated remote code execution issue exists in the underlying operating system. If specific preconditions outside of the attacker's control are met, a remote attacker could execute arbitrary code as a privileged user, potentially resulting in the complete compromise of the host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A privilege escalation issue exists in the API of HPE Networking Fabric Composer. An authenticated user with low privilege operator permissions can exploit this to gain administrative privileges, which could result in a complete system compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A stored cross-site scripting (XSS) issue exists in the web-based management interface. This allows an unauthenticated adjacent attacker to execute arbitrary script code in the browser of a user interacting with the interface. XSS is a type of attack where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A command sanitization bypass exists in the API of HPE Networking Fabric Composer. This flaw allows an authenticated user with low privilege operator permissions to escalate their privileges to those of an administrative user, which could result in a complete compromise of the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** An arbitrary file write flaw exists in the API of HPE Networking Fabric Composer. This issue allows an authenticated user with low privilege operator permissions to escalate their privileges. Successful exploitation could enable the attacker to execute arbitrary commands on the underlying operating system, potentially leading to a complete compromise of the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A flaw in the API allows an unauthenticated remote attacker to retrieve limited system information and modify the state of specific settings. This could enable an attacker to gain insight into internal services and workflows, potentially leading to unauthorized changes that disrupt normal service operations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** Privilege escalation flaws exist in the API of the platform. An authenticated user with low privilege operator permissions can perform state-changing actions that exceed their authorization level, which includes modifying the configuration of systems managed by the software. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A business logic vulnerability exists in the API of HPE Networking Fabric Composer. This flaw allows an authenticated user with low privilege operator permissions to obtain elevated privileges, enabling them to modify system settings beyond their authorized access level. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A flaw in the underlying operating system allows an unauthenticated adjacent attacker to execute arbitrary commands on the host. This occurs when specific preconditions outside the attacker's control are met. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** An unauthenticated remote attacker can conduct a denial of service attack via an API endpoint. Successful exploitation may allow limited unauthorized modifications to the underlying operating system and disrupt system availability, necessitating manual intervention to restore functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A privilege escalation issue exists in the API endpoint of HPE Networking Fabric Composer. This flaw allows an unauthenticated remote attacker to obtain administrative privileges, which could result in the complete compromise of the host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A flaw in the API allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host operating system, potentially leading to complete system compromise. This exploitation is possible if specific preconditions outside the attacker's control are met. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** Local privilege-escalation flaws allow a local attacker to execute arbitrary code with root privileges on the underlying operating system of the affected system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A sensitive information disclosure issue exists in the API of HPE Networking Fabric Composer. An authenticated user with low privilege operator permissions can access data that exceeds their authorized privilege level, which may facilitate further unauthorized access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A flaw in the API of HPE Networking Fabric Composer allows an unauthenticated remote attacker to perform a denial of service attack, which can disrupt the availability of the affected interface. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A remote code execution issue exists in the underlying operating system of the software. This flaw allows an unauthenticated remote attacker to execute arbitrary commands on the host as a privileged user, provided certain preconditions outside the attacker's control are met. Successful exploitation can lead to a complete compromise of the host system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A command injection flaw in the web-based management interface allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host operating system. This occurs when specific preconditions outside the attacker's control are met, potentially leading to a complete system compromise. Command injection is a flaw that allows an attacker to execute arbitrary system commands on a host operating system via a vulnerable application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** A flaw in the web-based management interface allows an unauthenticated remote attacker to access sensitive information. This occurs if an authenticated user is persuaded to interact with a specially crafted URL. The retrieved information could potentially be used to gain further access to network services supported by the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HPE Networking Fabric Composer (affected versions not specified) **Description** An authentication bypass exists in the underlying operating system of the software. This flaw allows an unauthenticated adjacent attacker to execute arbitrary code with privileged user permissions on the operating system, which can result in the complete compromise of the host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.