CVE-2023-4335: falha em Broadcom LSI Storage Authority (LSA)
Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.6%
Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux
CVEs relacionadas — Broadcom LSI Storage Authority (LSA)
No mesmo produto, das mais perigosas para as menos.
CVE-2023-4339—Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissionsEPSS 0.8%CVE-2023-4324—Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headersEPSS 0.7%CVE-2023-4325—Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilitiesEPSS 0.7%CVE-2023-4329—Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attributeEPSS 0.7%CVE-2023-4336—Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attributeEPSS 0.7%CVE-2023-4337—Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installationEPSS 0.7%