CVE-2024-53674: hewlett packard enterprise (hpe) hpe insight remote support
CVSS: 7.5v3.1HighAnalyzed
Published 26-11-2024Last modified 27-11-2024
Vulnerability summary
CVE-2024-53674 is a high (CVSS 7.5) vulnerability in hewlett packard enterprise (hpe) hpe insight remote support. EPSS estimates a 46.67% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
46.67%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 26-11-2024PublishedVulnerability first disclosed.
- 27-11-2024Last modifiedVulnerability information updated.
Description
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSources2 sources · 7.3–7.5
- CVE.orgCNA7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
46.67%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 46.67% on 18-09-2026
18-09-202618-10-2026
EPSS score46.67%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-91XML Injection (aka Blind XPath Injection)The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
- CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Affected systems
Hewlett packard enterprise (hpe)1 product
- hpe insight remote support< 7.14.0.629
Hpe1 product
- insight_remote_support< 7.14.0.629
2 vendors · 2 products