Cyber Resilience

CVE-2022-37940

Medium

Published: 22 March 2023

Published
22 March 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0020 42.3th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-37940 is a medium-severity Open Redirect (CWE-601) vulnerability in Hpe Flexfabric 5700 40Xg 2Qsfp\+ Firmware. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 42.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exploited to allow host header injection and URL redirection. HPE has made the following software to resolve the vulnerability in HPE FlexFabric…

more

5700 Switch Series version R2432P61 or later.

CWE(s)
CWE-601

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

hpe
flexfabric 5700 40xg 2qsfp\+ firmware
≤ r2432p61
hpe
flexfabric 5700 48g 4xg 2qsfp\+ firmware
≤ r2432p61

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AT-2 Literacy Training and Awareness
addresses: CWE-601

Security awareness includes verifying URLs and avoiding untrusted redirects that lead to malicious sites.

SI-10 Information Input Validation
addresses: CWE-601

Validates redirect targets and URLs to ensure they conform to allowed destinations.

References