CVE-2023-4329

3 documents3 sources

Severity

9.8CRITICAL

EPSS

0.1%

top 75.40%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Broadcom LSI Storage Authority (lsa)Intel Raid WEB Console 3 (rwc3)Broadcom Raid Controller WEB Interface

Timeline

PublishedAug 15

Description

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDbroadcom/raid_controller_web_interface51.12.0-2779

▶CVEListV5intel/raid_web_console_3_(rwc3)< 7.017.011.000

▶CVEListV5broadcom/lsi_storage_authority_(lsa)< 7.017.011.000

🔴Vulnerability Details

GHSA

GHSA-mmq9-xhf4-7wp2: Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameS↗2023-08-15

▶

CVEList

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute↗2023-08-15

▶