CVE-2023-6070 Vulnerability Details

  /     /     /  

CVE-2023-6070 Metadata Quick Info

CVE Published: 29/11/2023 | CVE Updated: 11/10/2024 | CVE Year: 2023
Source: trellix | Vendor: Trellix | Product: Trellix Enterprise Security Manager (ESM)
Status : PUBLISHED

---

CVE-2023-6070 Description

A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn\'t parse for invalid data

Metrics

CVSS Version: 3.1 | Base Score: 4.3 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* LOW
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* NONE
    Integrity Impact (I)* LOW
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID: CWE-918
CWE Name: CWE-918 Server-Side Request Forgery (SSRF)
Source: Trellix

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-176
CAPEC Description: CAPEC-176 Configuration/Environment Manipulation


Source: NVD (National Vulnerability Database).