cve/2021/CVE-2021-29209.md

### [CVE-2021-29209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29209)
![](https://img.shields.io/static/v1?label=Product&message=HPE%20Integrated%20Lights-Out%204%20(iLO%204)%20For%20HPE%20Gen9%20servers%3B%20HPE%20Integrated%20Lights-Out%205%20(iLO%205)%20for%20HPE%20Gen10%20Servers&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Prior%20to%20HPE%20Integrated%20Lights-Out%204%20(iLO%204)%20version%202.78%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=Prior%20to%20HPE%20Integrated%20Lights-Out%205%20(iLO%205)%20version%202.44%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=unspecified%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=remote%20dom%20xss%2C%20crlf%20injection&color=brightgreen)

### Description

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/kaje11/CVEs