The vulnerability in HPE OneView enables a remote attacker to manipulate the application into redirecting users to arbitrary URLs. This open redirect flaw (CWE‑601) can be exploited to mimic legitimate endpoints and facilitate phishing or social engineering attacks.

The affected product is Hewlett Packard Enterprise's HPE OneView management platform. No specific version information is provided, so any deployed instance of HPE OneView could be vulnerable until a vendor patch is applied.

The CVSS base score of 4.3 indicates moderate severity, and the EPSS score is not available, so the exploitation likelihood cannot be quantified precisely. The vulnerability has not been listed in CISA's KEV catalog. Attackers would need remote access to the HPE OneView web interface; by sending crafted HTTP requests they can trigger the redirect. The primary risk is user phishing and credential theft if users are redirected to malicious sites.