CVE-2023-4342
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The Broadcom RAID Controller web interface is vulnerable due to insecure defaults lacking an HTTP Strict-Transport-Security policy.
Risk Assessment
The absence of proper security policy may lead to man-in-the-middle attacks, jeopardizing the integrity and confidentiality of data transmitted through the interface.
Recommendation
It is recommended to configure the HTTP Strict-Transport-Security policy to secure communication with the RAID controller web interface.
Other vulnerabilities in Broadcom RAID Controller web interface
See all- CVE-2023-4329Critical
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not safeguard the SESSIONID cookie with the SameSite attribute.
- CVE-2023-4339High
The Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions.
- CVE-2023-4328Medium
The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Windows.
- CVE-2023-4327Medium
The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data, and the keys used for encryption are accessible to any local user on Linux.
Original NVD description (English source)
Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policy