PT-2023-28703 · Extreme Networks · Extreme Networks Switch Engine

David Yesland · Publicado 2023-10-16 · Atualizado 2023-12-09 · CVE-2023-43118

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Extreme Networks Switch Engine (EXOS) versions prior to 31.7.2 Extreme Networks Switch Engine (EXOS) versions prior to 32.5.1.5

Description A Cross Site Request Forgery (CSRF) issue in the Chalet application allows attackers to run arbitrary code and cause other unspecified impacts via the "/jsonrpc" API endpoint.

Recommendations For Extreme Networks Switch Engine (EXOS) versions prior to 31.7.2, update to version 31.7.2 or later to resolve the issue. For Extreme Networks Switch Engine (EXOS) versions prior to 32.5.1.5, update to version 32.5.1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/jsonrpc" API endpoint until a patch is applied.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-43118

Produtos afetados

Extreme Networks Switch Engine

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-43118 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-43118 · Aviso do Fabricante
• https://twitter.com/AndreBConte/status/1733560184230801830 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1714006552263163963 · Publicação no Twitter
• https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114379 · Aviso do Fabricante