This vulnerability in HPE ALE API permits an unauthenticated remote attacker to exploit a flaw by providing specially crafted input to an API endpoint, leading to the disclosure of sensitive information including password hashes. The CVSS 3.1 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and confidentiality impact limited to partial information disclosure. The affected versions are all releases up to 5.0.0.0 inclusive. No vendor advisory or patch information is currently available.

Successful exploitation can disclose sensitive user information such as password hashes, which could be leveraged by attackers to conduct further attacks. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the ALE API endpoints to trusted users and networks where possible to reduce exposure.