Paper/Archive/CVE-2023-4336

CVE-2023-4336

Broadcom LSI Storage Authority (LSA) — Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attribute

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 53.3.533 × 2010.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attribute

Affected

ProductAffectedFixed inSource

LSI Storage Authority (LSA)< 7.017.011.0007.017.011.000CNA

RAID Web Console 3 (RWC3)< 7.017.011.0007.017.011.000CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbroadcom.com/support/resources/product-security-center refintel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html