CVE-2023-5648
Quick assessment
Affected
Brocade Active Support Connectivity Gateway
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Brocade ASCG 3.0 版本之前的版本中，多个 Brocade ASCG URL 路径缺少若干与安全相关的 HTTP 头信息，这可能导致未经身份验证的攻击者执行跨站脚本（Cross-Site Scripting）、点击劫持（Clickjacking）、信息泄露等攻击。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-5648
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Brocade | Active Support Connectivity Gateway | 0 ~ 3.0 | - |
|
II. Public POCs for CVE-2023-5648
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-5648
请登录查看更多情报信息。
Other References for CVE-2023-5648 (1)
Same Patch Batch · Brocade · 2026-10-08 · 61 CVEs total
| CVE-2026-85489 | 8.7 HIGH | Brocade ASCG<3.5.0 认证绕过漏洞 |
| CVE-2026-87684 | 8.7 HIGH | Brocade Fabric<10.0.1 SNMP守护进程栈缓冲区溢出漏洞 |
| CVE-2026-85421 | 8.7 HIGH | Brocade ASCG <3.5.0 身份验证绕过导致远程代码执行 |
| CVE-2026-87424 | 8.6 HIGH | Brocade ASCG<3.5.0认证绕过漏洞 |
| CVE-2026-87682 | 8.6 HIGH | Brocade Fabric OS<10.0.1命令注入漏洞 |
| CVE-2026-87683 | 8.6 HIGH | Brocade Fabric OS堆缓冲区溢出漏洞 |
| CVE-2026-85487 | 8.6 HIGH | Brocade ASCG<3.5.0路径穿越致任意文件操作 |
| CVE-2026-85486 | 8.6 HIGH | Brocade ASCG <3.5.0 任意代码执行漏洞 |
| CVE-2026-85423 | 8.6 HIGH | Brocade ASCG 3.5.0前未授权命令执行漏洞 |
| CVE-2026-87666 | 8.6 HIGH | Brocade Fabric OS 9.2.2d/10.0.0a1 OS命令注入漏洞 |
| CVE-2026-94581 | 8.5 HIGH | Brocade Fabric OS 9.2.2d前及10.0.0-10.0.0a1远程命令注入漏洞 |
| CVE-2026-87688 | 8.5 HIGH | Brocade Fabric OS远程命令执行漏洞 |
| CVE-2026-87680 | 8.5 HIGH | Brocade Fabric OS命令注入漏洞 |
| CVE-2026-87679 | 8.5 HIGH | Brocade Fabric OS<10.0.1堆溢出漏洞 |
| CVE-2026-87687 | 8.5 HIGH | Brocade Fabric OS 垂直提权与越权漏洞 |
| CVE-2026-87674 | 8.5 HIGH | Brocade Fabric OS本地提权漏洞（9.2.2d/10.0.0） |
| CVE-2026-87664 | 8.5 HIGH | Brocade Fabric OS会话伪造漏洞 |
| CVE-2026-94586 | 8.5 HIGH | Brocade Fabric OS命令注入漏洞（低于9.2.2d/10.0.0a1） |
| CVE-2026-87428 | 8.4 HIGH | Brocade ASCG 3.5.0前凭据泄露漏洞 |
| CVE-2026-87667 | 8.4 HIGH | Brocade Fabric OS参数注入漏洞 |
Showing top 20 of 61 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same weakness: CWE-79
-
CVE-2026-94154
Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site -
CVE-2026-95595
WordPress Disable and Remove Google Fonts | GDPR & DSGVO fri -
CVE-2026-94670
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripti -
CVE-2026-94662
WordPress Unlimited Elements For Elementor plugin <= 2.0.19 -
CVE-2026-107272
Gophish through 0.12.1 XSS via Unescaped SMTP Server Error M
V. Comments for CVE-2023-5648
No comments yet