CVE-2023-4341

CVE-2023-4341: vulnerability in Broadcom LSI Storage Authority (LSA)

Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI

Published · Updated

Follow this CVE+ Monitor RAID Web Console+ Monitor LSI Storage Authority

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.7%
Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI
Affected products
Broadcom · LSI Storage Authority (LSA)Intel · RAID Web Console 3 (RWC3)
Related CVEs — Broadcom LSI Storage Authority (LSA)

In the same product, most dangerous first.

CVE-2023-4339—Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissionsEPSS 0.8%CVE-2023-4324—Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headersEPSS 0.7%CVE-2023-4325—Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilitiesEPSS 0.7%CVE-2023-4329—Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attributeEPSS 0.7%CVE-2023-4336—Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attributeEPSS 0.7%CVE-2023-4337—Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installationEPSS 0.7%