Unauthenticated Improper Certificate Validation Leads to Authentication Bypass in HPE Networking Fabric Composer

Summary

An improper certificate validation vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.

Remediation

1. Inventory every Hewlett Packard Enterprise (HPE) Fabric Composer deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05172en_us&docLocale=en_US