CVE-2023-4327
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Linux.
Risk Assessment
The exposure of sensitive data and encryption keys may lead to serious security breaches, including unauthorized access to data.
Recommendation
It is recommended to restrict access to the web interface and implement additional security measures to protect sensitive data and encryption keys.
Other vulnerabilities in Broadcom RAID Controller web interface
See all- CVE-2023-4342Critical
The Broadcom RAID Controller web interface is vulnerable due to insecure defaults lacking an HTTP Strict-Transport-Security policy.
- CVE-2023-4329Critical
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not safeguard the SESSIONID cookie with the SameSite attribute.
- CVE-2023-4339High
The Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions.
- CVE-2023-4328Medium
The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Windows.
Original NVD description (English source)
Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux
Vulnerability data from NVD (NIST) · CISA KEV · EPSS