Raid Controller Web Interface
CVE-2023-4343
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter
AnalysisAI
Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter Affected products include: Broadcom Raid Controller Web Interface.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup
Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security
Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI. R
Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log file
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide
Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installa
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safegua
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safegua
Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilities. Rated c
Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy he
Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup.
Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today