Lucene search

TrellixCVELIST:CVE-2023-3263

HistoryAug 14, 2023 - 4:02 a.m.

CVE-2023-3263

2023-08-1404:02:55

CWE-289

trellix

www.cve.org

dataprobe iboot pdu

firmware vulnerability

authentication bypass

rest api

special characters

credentials

exploitation

authorization token

power distribution

relays

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.9%

JSON

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when parsing credentials.Successful exploitation allows the malicious agent to obtain a valid authorization token and read information relating to the state of the relays and power distribution.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "iBoot PDU",
    "vendor": "Dataprobe",
    "versions": [
      {
        "lessThanOrEqual": "<= 1.43.03312023",
        "status": "affected",
        "version": "1.43.03312023",
        "versionType": "custom"
      }
    ]
  }
]

References

www.trellix.com/en-us/about/newsroom/stories/research/the-threat-lurking-in-data-centers.html

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.9%

JSON

Related for CVELIST:CVE-2023-3263