PT-2023-28703 · Extreme Networks · Extreme Networks Switch Engine

David Yesland · Published 2023-10-16 · Updated 2023-12-09 · CVE-2023-43118

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Extreme Networks Switch Engine (EXOS) versions prior to 31.7.2 Extreme Networks Switch Engine (EXOS) versions prior to 32.5.1.5

Description A Cross Site Request Forgery (CSRF) issue in the Chalet application allows attackers to run arbitrary code and cause other unspecified impacts via the "/jsonrpc" API endpoint.

Recommendations For Extreme Networks Switch Engine (EXOS) versions prior to 31.7.2, update to version 31.7.2 or later to resolve the issue. For Extreme Networks Switch Engine (EXOS) versions prior to 32.5.1.5, update to version 32.5.1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/jsonrpc" API endpoint until a patch is applied.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-43118

Affected Products

Extreme Networks Switch Engine

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-43118 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43118 · Vendor Advisory
• https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114379 · Vendor Advisory
• https://twitter.com/AndreBConte/status/1733560184230801830 · Twitter Post
• https://twitter.com/CVEnew/status/1714006552263163963 · Twitter Post