CVE-2023-4324 - Vulnerability Details - OpenCVE

Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Broadcom	Lsi Storage Authority Raid Controller Web Interface
Intel	Raid Web Console 3

Configuration 1 [-]

cpe:2.3:a:broadcom:raid_controller_web_interface:51.12.0-2779:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.broadcom.com/support/resources/product-security-center

History

Tue, 08 Oct 2024 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Broadcom lsi Storage Authority Intel Intel raid Web Console 3
CPEs		cpe:2.3:a:broadcom:lsi_storage_authority:::::::: cpe:2.3:a:intel:raid_web_console_3:-:::::windows::
Vendors & Products		Broadcom lsi Storage Authority Intel Intel raid Web Console 3
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2023-08-15T18:25:38.873Z

Updated: 2024-10-08T17:57:24.262Z

Reserved: 2023-08-14T21:06:24.381Z

Link: CVE-2023-4324

Vulnrichment

Updated: 2024-08-02T07:24:04.566Z

NVD

Status : Modified

Published: 2023-08-15T19:15:10.847

Modified: 2024-11-21T08:34:51.437

Link: CVE-2023-4324

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4324", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2023-08-14T21:06:24.381Z", "datePublished": "2023-08-15T18:25:38.873Z", "dateUpdated": "2024-10-08T17:57:24.262Z"}, "containers": {"cna": {"title": "Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers", "descriptions": [{"lang": "en", "value": "Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers"}], "source": {"discovery": "EXTERNAL"}, "affected": [{"defaultStatus": "affected", "product": "LSI Storage Authority (LSA)", "vendor": "Broadcom", "versions": [{"lessThan": "7.017.011.000", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "RAID Web Console 3 (RWC3)", "vendor": "Intel", "versions": [{"lessThan": "7.017.011.000", "status": "affected", "version": "0", "versionType": "custom"}]}], "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center"}], "x_generator": {"engine": "cveClient/1.0.14"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2023-09-16T02:04:23.250Z"}, "credits": [{"lang": "en", "value": "Intel DCG", "type": "finder"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative."}], "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative."}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:24:04.566Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "broadcom", "product": "lsi_storage_authority", "cpes": ["cpe:2.3:a:broadcom:lsi_storage_authority:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "7.017.011.000", "versionType": "custom"}]}, {"vendor": "intel", "product": "raid_web_console_3", "cpes": ["cpe:2.3:a:intel:raid_web_console_3:-:*:*:*:*:windows:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "7.017.011.000", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-08T17:54:08.973670Z", "id": "CVE-2023-4324", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T17:57:24.262Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:24:04.566Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-4324", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-08T17:54:08.973670Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:broadcom:lsi_storage_authority:*:*:*:*:*:*:*:*"], "vendor": "broadcom", "product": "lsi_storage_authority", "versions": [{"status": "affected", "version": "0", "lessThan": "7.017.011.000", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:intel:raid_web_console_3:-:*:*:*:*:windows:*:*"], "vendor": "intel", "product": "raid_web_console_3", "versions": [{"status": "affected", "version": "0", "lessThan": "7.017.011.000", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-08T17:57:17.824Z"}}], "cna": {"title": "Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Intel DCG"}], "affected": [{"vendor": "Broadcom", "product": "LSI Storage Authority (LSA)", "versions": [{"status": "affected", "version": "0", "lessThan": "7.017.011.000", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "Intel", "product": "RAID Web Console 3 (RWC3)", "versions": [{"status": "affected", "version": "0", "lessThan": "7.017.011.000", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative.", "supportingMedia": [{"type": "text/html", "value": "This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative.", "base64": false}]}], "references": [{"url": "https://www.broadcom.com/support/resources/product-security-center"}], "x_generator": {"engine": "cveClient/1.0.14"}, "descriptions": [{"lang": "en", "value": "Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers"}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2023-09-16T02:04:23.250Z"}}}, "cveMetadata": {"cveId": "CVE-2023-4324", "state": "PUBLISHED", "dateUpdated": "2024-10-08T17:57:24.262Z", "dateReserved": "2023-08-14T21:06:24.381Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2023-08-15T18:25:38.873Z", "assignerShortName": "certcc"}, "dataVersion": "5.1"}