PT-2023-28706 · Extreme Networks · Extreme Networks Switch Engine

David Yesland · Published 2023-10-16 · Updated 2023-12-09 · CVE-2023-43121

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Extreme Networks Switch Engine (EXOS) versions prior to 32.5.1.5 Extreme Networks Switch Engine (EXOS) versions prior to 22.7 Extreme Networks Switch Engine (EXOS) versions prior to 31.7.2

Description A Directory Traversal issue allows attackers to read arbitrary files.

Recommendations For versions prior to 32.5.1.5, update to version 32.5.1.5 or later. For versions prior to 22.7, update to version 22.7 or later. For versions prior to 31.7.2, update to version 31.7.2 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-43121

Affected Products

Extreme Networks Switch Engine

References · 6

• https://osv.dev/vulnerability/CVE-2023-43121 · Vendor Advisory
• https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114376 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43121 · Security Note
• https://twitter.com/AndreBConte/status/1733560184230801830 · Twitter Post
• https://twitter.com/IT_securitynews/status/1714575912665006456 · Twitter Post
• https://twitter.com/CVEnew/status/1713996726086832152 · Twitter Post