This vulnerability, identified as CWE-79, is a cross-site scripting issue in HPE OneView that arises from improper input neutralization during web page generation. Exploiting this flaw could enable remote attackers to hijack user sessions or conduct unauthorized activities by injecting malicious scripts. The CVSS 3.1 base score is 8.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. Confidentiality impact is high, integrity impact is low, and availability impact is none. The affected versions are all releases from 0 up to but excluding 11.40.

Successful exploitation can lead to remote session hijacking or unauthorized actions within HPE OneView environments. The confidentiality impact is high, meaning sensitive information could be exposed. Integrity impact is low, and availability is not affected. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Hewlett Packard Enterprise advisories for updates. Until a fix is available, consider limiting exposure of HPE OneView interfaces and applying any recommended temporary mitigations from the vendor.