CVE-2023-4333
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The Broadcom RAID Controller web interface does not enforce SSL cipher ordering by the server, potentially leading to security vulnerabilities.
Risk Assessment
The lack of enforced SSL cipher ordering may allow attackers to intercept or manipulate data transmitted between the server and client.
Recommendation
It is recommended to configure the server to enforce proper SSL cipher ordering and to regularly update the RAID controller software.
Other vulnerabilities in Broadcom RAID Controller
See all- CVE-2023-4344Critical
The Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to set up CIM connection.
- CVE-2023-4341Critical
Broadcom RAID Controller is vulnerable to privilege escalation to root due to the creation of insecure folders by the Web GUI.
- CVE-2023-4340Critical
Broadcom RAID Controller is vulnerable to privilege escalation by taking advantage of session prints in the log file.
- CVE-2023-4338Critical
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not provide X-Content-Type-Options headers.
- CVE-2023-4337Critical
The Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation.
- CVE-2023-4324Critical
The Broadcom RAID Controller web interface is vulnerable due to insecure defaults lacking HTTP Content-Security-Policy headers.
- CVE-2023-4323Critical
The Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup.
- CVE-2023-4343High
The Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter.
- CVE-2023-4332High
The Broadcom RAID Controller web interface is vulnerable due to improper permissions on the log file.
- CVE-2023-4345Medium
The Broadcom RAID Controller web interface is vulnerable to client-side control bypass, leading to unauthorized data access for low privileged users.
Original NVD description (English source)
Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server
Vulnerability data from NVD (NIST) · CISA KEV · EPSS