Paper/Archive/CVE-2023-4329

CVE-2023-4329

Broadcom LSI Storage Authority (LSA) — Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 53.3.533 × 2010.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute

Affected

ProductAffectedFixed inSource

LSI Storage Authority (LSA)< 7.017.011.0007.017.011.000CNA

RAID Web Console 3 (RWC3)< 7.017.011.0007.017.011.000CNA

lsi_storage_authority< 7.017.011.0007.017.011.000CISA-ADP

raid_web_console_3< 7.017.011.0007.017.011.000CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbroadcom.com/support/resources/product-security-center refintel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html