Main Vulnerability Database Vulnerabilities #VU107592

Inconsistent interpretation of HTTP requests in HPE products - CVE-2023-30910

Published: April 17, 2025

Vulnerability identifier: #VU107592

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-30910

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote user can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Affected software

HPE MSA 2062 Storage
HPE MSA 2060 Storage
HPE MSA 1060 Storage

How to mitigate CVE-2023-30910

Install updates from vendor's website.

HPE MSA 2062 Storage - update to IN210R004
HPE MSA 2060 Storage - update to IN210R004
HPE MSA 1060 Storage - update to IN210R004

External References

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbst04539en_us

Related Security Bulletins