CVE-2023-6070
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Summary
CVE-2023-6070 is a server-side request forgery vulnerability affecting ESM versions prior to 11.6.8, allowing a low privileged authenticated user to upload arbitrary content, potentially altering configuration. The vulnerability lies in the certificate validation functionality, which accepts uploaded content without parsing for invalid data. Two products, t1jDy2 and t1jDy1, are affected by this vulnerability. The risk score is 5 out of 10, indicating a medium severity level. The exploitability score is 2.8 out of 10, with low privileges required and no user interaction needed. The attack vector is through the network and the potential impact includes low integrity and no confidentiality impact. Organizations should update their ESM software to version 11.6.8 or later to remediate this vulnerability and mitigate the potential risks it poses to their systems and configurations.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions