CVE-2023-4339
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions.
Risk Assessment
The exposure of private keys may lead to unauthorized access to systems and data, posing a serious security threat to the organization.
Recommendation
It is recommended to review and improve file permissions to secure private keys from unauthorized access.
Other vulnerabilities in Broadcom RAID Controller web interface
See all- CVE-2023-4342Critical
The Broadcom RAID Controller web interface is vulnerable due to insecure defaults lacking an HTTP Strict-Transport-Security policy.
- CVE-2023-4329Critical
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not safeguard the SESSIONID cookie with the SameSite attribute.
- CVE-2023-4328Medium
The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Windows.
- CVE-2023-4327Medium
The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Linux.
Original NVD description (English source)
Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions