CVSS 3.1 Score 4.3 of 10 (medium)


Published Nov 29, 2023
Updated: Dec 5, 2023
CWE ID 918


CVE-2023-6070 is a server-side request forgery vulnerability affecting ESM versions prior to 11.6.8, allowing a low privileged authenticated user to upload arbitrary content, potentially altering configuration. The vulnerability lies in the certificate validation functionality, which accepts uploaded content without parsing for invalid data. Two products, t1jDy2 and t1jDy1, are affected by this vulnerability. The risk score is 5 out of 10, indicating a medium severity level. The exploitability score is 2.8 out of 10, with low privileges required and no user interaction needed. The attack vector is through the network and the potential impact includes low integrity and no confidentiality impact. Organizations should update their ESM software to version 11.6.8 or later to remediate this vulnerability and mitigate the potential risks it poses to their systems and configurations.


Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-6070 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options