CVE-2023-4329

CVE-2023-4329: fallo en Broadcom LSI Storage Authority (LSA)

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear RAID Web Console+ Monitorear LSI Storage Authority

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 0.7%
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute
Productos afectados
Broadcom · LSI Storage Authority (LSA)Intel · RAID Web Console 3 (RWC3)
CVEs relacionadas — Broadcom LSI Storage Authority (LSA)

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-4339—Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissionsEPSS 0.8%CVE-2023-4324—Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headersEPSS 0.7%CVE-2023-4325—Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilitiesEPSS 0.7%CVE-2023-4336—Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attributeEPSS 0.7%CVE-2023-4337—Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installationEPSS 0.7%CVE-2023-4338—Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options HeadersEPSS 0.7%