Description

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-09-01T20:17:17.343Z",
  "pubdate": "2026-09-01T20:17:17.343Z",
  "executiveSummary": "HPE Networking Fabric Composer is susceptible to a stored cross-site scripting (XSS) vulnerability within its web-based management interface. This security flaw enables a low-privileged authenticated user to inject malicious scripts into the application, which are subsequently stored on the server. When an administrative user accesses the affected interface component, the stored payload is executed within the context of the administrator's session. The vulnerability allows an attacker to bypass standard authorization controls by leveraging the higher privilege level of the victim. Successful exploitation grants the attacker the ability to execute arbitrary client-side code, potentially leading to unauthorized actions, session hijacking, or exfiltration of sensitive configuration data managed by the administrator. Given the administrative nature of the target audience, the risk implications are high, as the integrity and confidentiality of the entire networking fabric management could be compromised. Exploitation requires valid, low-privilege authentication to the management console and the ability to interact with interface elements that lack sufficient input sanitization or output encoding.",
  "technicalDetails": "The vulnerability resides in the sanitization and output rendering mechanisms of the HPE Networking Fabric Composer web-based management interface. It is classified as a stored (persistent) Cross-Site Scripting (XSS) vulnerability. The root cause is identified as the failure of the application to properly sanitize user-supplied input before it is stored in the underlying database and subsequently rendered in the browser of another user, specifically an administrator.\nThe attack flow commences when a low-privileged authenticated operator injects a crafted malicious payload—typically containing JavaScript—into a field within the management interface that is persisted by the application. Because the application does not implement adequate input validation or context-aware output encoding, the payload is accepted by the server and stored in the application backend.\nThe malicious script remains dormant until an administrative user navigates to the specific view or management console page where the injected data is retrieved and displayed. Upon loading the page, the browser treats the stored payload as legitimate code belonging to the application's origin, thereby executing the script within the security context of the administrative session. This bypasses the Same-Origin Policy (SOP) constraints.\nThe impact of the script execution is dictated by the administrator's current privileges. As the script runs in the context of the administrator’s browser, the attacker can perform unauthorized API requests, modify network fabric configurations, create new administrative accounts, or intercept sensitive tokens transmitted through the browser. Furthermore, the attacker could theoretically perform reconnaissance on the network management backend by proxying requests through the administrator's established session, effectively escalating their reach within the infrastructure managed by Fabric Composer.\nThe vulnerability is restricted to the web-based management interface. While external network exposure depends on the deployment configuration of the Fabric Composer instance, the primary requirement for exploitation is a legitimate, authenticated session as an operator. No specialized network tools beyond standard web browser capabilities are required to deliver the payload, making it an application-layer attack vector that relies on the trust relationship between the management interface and its authenticated users."
}