CVE-2023-4334

CVE-2023-4334: fallo en Broadcom LSI Storage Authority (LSA)

Broadcom RAID Controller Web server (nginx) is serving private files without any authentication

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear RAID Web Console+ Monitorear LSI Storage Authority

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 0.6%
Broadcom RAID Controller Web server (nginx) is serving private files without any authentication
Productos afectados
Broadcom · LSI Storage Authority (LSA)Intel · RAID Web Console 3 (RWC3)
CVEs relacionadas — Broadcom LSI Storage Authority (LSA)

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-4339—Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissionsEPSS 0.8%CVE-2023-4324—Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headersEPSS 0.7%CVE-2023-4325—Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilitiesEPSS 0.7%CVE-2023-4329—Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attributeEPSS 0.7%CVE-2023-4336—Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attributeEPSS 0.7%CVE-2023-4337—Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installationEPSS 0.7%