A cross-site scripting flaw exists in HPE OneView that would allow an attacker to inject malicious scripts into the web interface. This could result in hijacking user sessions or executing other unauthorized actions, potentially exposing authentication credentials or enabling further compromise of the management platform. The flaw is identified as CWE‑79.

Hewlett Packard Enterprise’s HPE OneView management platform is affected. No specific affected versions are listed in the advisory, so any configuration running the product is potentially vulnerable.

The vulnerability carries a CVSS score of 8.2, signifying high severity, while an EPSS score of less than 1% indicates a low probability of widespread exploitation. It is not included in the CISA KEV catalog. The likely attack vector is the web UI of HPE OneView, but this path is inferred rather than explicitly stated in the CVE description.