Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2023-4329— Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute

Quick assessment

Affected
Broadcom LSI Storage Authority (LSA)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Broadcom RAID Controller是美国博通（Broadcom）公司的一系列 RAID 控制器。 Broadcom RAID Controller存在安全漏洞，该漏洞源于web界面存在不安全的HTTP，导致无法保护具有SameSite属性的SESSIONID cookie。

AI Predicted 5.4 Difficulty: Easy EPSS 0.70% · P51

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-4329

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute
Source: CVE Program / CVE List V5
Vulnerability Description
Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Broadcom RAID Controller 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Broadcom RAID Controller是美国博通（Broadcom）公司的一系列 RAID 控制器。 Broadcom RAID Controller存在安全漏洞，该漏洞源于web界面存在不安全的HTTP，导致无法保护具有SameSite属性的SESSIONID cookie。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Broadcom LSI Storage Authority (LSA) 0 ~ 7.017.011.000 -
Intel RAID Web Console 3 (RWC3) 0 ~ 7.017.011.000 -

II. Public POCs for CVE-2023-4329

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-4329

请登录查看更多情报信息。

Other References for CVE-2023-4329 (1)

Same Patch Batch · Broadcom · 2023-08-15 · 22 CVEs total

CVE-2023-4334 Broadcom RAID Controller Web server (nginx) is serving private files without any authentic
CVE-2023-4345 Broadcom RAID Controller web interface is vulnerable client-side control bypass
CVE-2023-4323 Broadcom RAID Controller web interface is vulnerable to improper session management of act
CVE-2023-4324 Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking H
CVE-2023-4325 Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has
CVE-2023-4326 Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configura
CVE-2023-4327 Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the
CVE-2023-4328 Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and th
CVE-2023-4331 Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configura
CVE-2023-4332 Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the lo
CVE-2023-4333 Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server
CVE-2023-4344 Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to imp
CVE-2023-4335 Broadcom RAID Controller Web server (nginx) is serving private server-side files without a
CVE-2023-4336 Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP confi
CVE-2023-4337 Broadcom RAID Controller web interface is vulnerable to improper session handling of manag
CVE-2023-4338 Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP confi
CVE-2023-4339 Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for
CVE-2023-4340 Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the
CVE-2023-4341 Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of
CVE-2023-4342 Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking H

Showing top 20 of 22 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: LSI Storage Authority (LSA)
Same vendor: Broadcom

V. Comments for CVE-2023-4329

No comments yet

Leave a comment