QID 730100

HPE Integrated Lights-Out (iLO) is an embedded server management technology used for out-of-band management.

HPE Integrated Lights-Out (iLO) firmware suffers from local buffer overflow and multiple client side vulnerabilities like XSS.

Affected Versions:
HPE Integrated Lights-Out 5 (iLO 5) Prior to v2.44
HPE Integrated Lights-Out 4 (iLO 4) Prior to v2.78

NOTE:
HPESBHF04133: Applicable for HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers - Prior to version 2.44
HPESBHF04121: Applicable for HPE Integrated Lights-Out 4 (iLO 4) - Prior to version 2.78
HPESBHF04134: Applicable for HPE Integrated Lights-Out 5(iLO 5) for HPE Gen10 Servers and HPE Integrated Lights-Out 4 (iLO 4)

QID Detection Logic(Unauthenticated):
This QID checks for vulnerable version of HPE Integrated Lights-Out via an HTTP request to "xmldata?item=All" URL.

Successful exploitation of these vulnerabilities may allow an privileged attacker to execute arbitrary code on the target.