Broadcom RAID controller web interface: password exposed as a URL search parameter

CVSS 7.5CVE-2023-4343Firmware, BMC & network fabriccurated

Impact

The RAID controller web interface puts password information in the URL as a search parameter. URLs end up in proxy logs, browser history, web server logs and Referer headers, so the storage-management credential can leak to anyone who can read those. With that password, an attacker can use the RAID management console on that host. This is a different flaw from CVE-2023-4339 (key file permissions) in the same product and advisory.

Who can reach it

Network-reachable according to the CVSS vector (AV:N/PR:N). The attacker needs to see URLs from an admin's session, for example through logs, proxies or history, and no authentication of their own.

What to do

Update LSA or RWC3 following the Broadcom product security center and Intel SA-00926. The record lists 51.12.0-2779 as affected and gives no fixed version. Change RAID console passwords that may have been logged, scrub any proxy or web logs that captured them, and keep the console reachable only from the management network.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-4343 https://www.broadcom.com/support/resources/product-security-center https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.