CVE-2023-4329
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not safeguard the SESSIONID cookie with the SameSite attribute.
Risk Assessment
The lack of proper protection for the SESSIONID cookie may lead to Cross-Site Request Forgery (CSRF) attacks, jeopardizing user session integrity.
Recommendation
It is recommended to configure the SameSite attribute for the SESSIONID cookie to enhance the security of the web interface.
Other vulnerabilities in Broadcom RAID Controller web interface
See all- CVE-2023-4342Critical
The Broadcom RAID Controller web interface is vulnerable due to insecure defaults lacking an HTTP Strict-Transport-Security policy.
- CVE-2023-4339High
The Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions.
- CVE-2023-4328Medium
The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Windows.
- CVE-2023-4327Medium
The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Linux.
Original NVD description (English source)
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute