Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-30909 is a critical-severity Authentication Bypass by Capture-replay (CWE-294) vulnerability in Hp Oneview. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Protocol or Service Impersonation (T1001.003); ranked in the top 26% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A remote authentication bypass vulnerability, tracked as CVE-2023-30909, affects certain APIs in HPE OneView. The flaw carries a CVSS 3.1 base score of 9.8 and is associated with CWE-294, indicating an authentication mechanism that can be circumvented over the network without requiring credentials or user interaction.
An unauthenticated remote attacker can exploit the issue to bypass authentication controls on the exposed APIs. Successful exploitation grants the attacker full read, write, and delete access to affected resources, resulting in complete compromise of confidentiality, integrity, and availability.
HPE has published advisory hpesbgn04538en_us, which details the affected OneView versions and provides remediation guidance, including available software updates and configuration changes to address the authentication bypass.
The EPSS score for this CVE has remained flat at 0.0541 since disclosure, indicating no material increase in observed exploitation interest.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-35249
Vulnerability Data
A remote authentication bypass issue exists in some OneView APIs.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.16V10.5.1
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Allows detection of capture-replay attacks by showing the replayed logon's timestamp as the last logon.
Protects against replay of captured session tokens or credentials by requiring authenticated, fresh session channels.
Wireless link protections commonly incorporate replay protection, reducing the exploitability of capture-replay weaknesses.
Accurate synchronized time enables tight timestamp windows that directly limit capture-replay windows in authentication protocols.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Network monitoring may detect anomalous replays after the fact but does not prevent the design flaw.
Strong authentication methods can reduce replay risk but do not inherently address captured messages.
Protecting and verifying identity assertions prevents replay of captured authentication material.
Encryption and integrity protections for data-in-transit directly block capture-replay of credentials or tokens.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.