Authenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composer (Hewlett Packard Enterprise (HPE) Fabric Composer)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.53 % · percentile 45 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hpe
- NVD status
- Modified
Description
Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Networking Fabric Composer instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the HPE Networking Fabric Composer host.
Weaknesses (CWE)
- CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | hpe |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · security-alert@hpe.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-69448
- GCVE · GCVE-0-2026-73721
CERT-FR advisories
- CERTFR-2026-AVI-1104 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:arubanetworks:fabric_composer:*:*:*:*:*:*:*:*< 7.3.4
Affected products
| Product | Versions |
|---|---|
| Hewlett Packard Enterprise (HPE) · Fabric Composer | affected 7.0.0 ≤ 7.3.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |