CVE-2023-4335: vulnerability in Broadcom LSI Storage Authority (LSA)
Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.6%
Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux
Related CVEs — Broadcom LSI Storage Authority (LSA)
In the same product, most dangerous first.
CVE-2023-4339—Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissionsEPSS 0.8%CVE-2023-4324—Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headersEPSS 0.7%CVE-2023-4325—Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilitiesEPSS 0.7%CVE-2023-4329—Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attributeEPSS 0.7%CVE-2023-4336—Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attributeEPSS 0.7%CVE-2023-4337—Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installationEPSS 0.7%