CVE-2023-4334 - Vulnerability Details - OpenCVE

Broadcom RAID Controller Web server (nginx) is serving private files without any authentication

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00053.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Broadcom	Raid Controller Web Interface

Configuration 1 [-]

cpe:2.3:a:broadcom:raid_controller_web_interface:51.12.0-2779:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-54199	Broadcom RAID Controller Web server (nginx) is serving private files without any authentication

Fixes

Solution

This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.broadcom.com/support/resources/product-security-center

History

Tue, 08 Oct 2024 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2023-08-15T18:25:37.123Z

Updated: 2024-10-08T19:35:21.552Z

Reserved: 2023-08-14T21:25:58.724Z

Link: CVE-2023-4334

Vulnrichment

Updated: 2024-08-02T07:24:04.532Z

NVD

Status : Modified

Published: 2023-08-15T19:15:11.397

Modified: 2024-11-21T08:34:52.573

Link: CVE-2023-4334

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4334", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2023-08-14T21:25:58.724Z", "datePublished": "2023-08-15T18:25:37.123Z", "dateUpdated": "2024-10-08T19:35:21.552Z"}, "containers": {"cna": {"title": "Broadcom RAID Controller Web server (nginx) is serving private files without any authentication", "descriptions": [{"lang": "en", "value": "Broadcom RAID Controller Web server (nginx) is serving private files without any authentication"}], "source": {"discovery": "EXTERNAL"}, "affected": [{"defaultStatus": "affected", "product": "LSI Storage Authority (LSA)", "vendor": "Broadcom", "versions": [{"lessThan": "7.017.011.000", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAID Web Console 3 (RWC3)", "vendor": "Intel", "versions": [{"lessThan": "7.017.011.000", "status": "affected", "version": "0", "versionType": "custom"}]}], "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center"}], "x_generator": {"engine": "cveClient/1.0.14"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2023-09-16T02:04:24.923Z"}, "credits": [{"lang": "en", "value": "Intel DCG", "type": "finder"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative."}], "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative."}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:24:04.532Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-08T19:35:07.326506Z", "id": "CVE-2023-4334", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T19:35:21.552Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:24:04.532Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-4334", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-08T19:35:07.326506Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T19:35:17.789Z"}}], "cna": {"title": "Broadcom RAID Controller Web server (nginx) is serving private files without any authentication", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Intel DCG"}], "affected": [{"vendor": "Broadcom", "product": "LSI Storage Authority (LSA)", "versions": [{"status": "affected", "version": "0", "lessThan": "7.017.011.000", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "Intel", "product": "RAID Web Console 3 (RWC3)", "versions": [{"status": "affected", "version": "0", "lessThan": "7.017.011.000", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative.", "supportingMedia": [{"type": "text/html", "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative.", "base64": false}]}], "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center"}], "x_generator": {"engine": "cveClient/1.0.14"}, "descriptions": [{"lang": "en", "value": "Broadcom RAID Controller Web server (nginx) is serving private files without any authentication"}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2023-09-16T02:04:24.923Z"}}}, "cveMetadata": {"cveId": "CVE-2023-4334", "state": "PUBLISHED", "dateUpdated": "2024-10-08T19:35:21.552Z", "dateReserved": "2023-08-14T21:25:58.724Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2023-08-15T18:25:37.123Z", "assignerShortName": "certcc"}, "dataVersion": "5.1"}