Lucene search

[email protected]NVD:CVE-2023-6070

HistoryNov 29, 2023 - 9:15 a.m.

CVE-2023-6070

2023-11-2909:15:21

CWE-918

[email protected]

web.nvd.nist.gov

esm

server-side request forgery

vulnerability

uploading

arbitrary content

configuration alteration

certificate validation

api

invalid data

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

Percentile

14.0%

JSON

A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn’t parse for invalid data

Affected configurations

Nvd

Node

trellixenterprise_security_managerRange<11.6.8

VendorProductVersionCPE
trellixenterprise_security_manager*cpe:2.3:a:trellix:enterprise_security_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trellix	enterprise_security_manager	*	cpe:2.3:a:trellix:enterprise_security_manager::::::::

References

kcm.trellix.com/corporate/index?page=content&id=SB10413

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

Percentile

14.0%

JSON

Related for NVD:CVE-2023-6070

prion1 cvelist1 cve1