CVE-2023-43119

An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated privileges using crafted telnet commands via Redis server.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114378	Vendor Advisory
https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114378	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:extremenetworks:exos::::::::
	cpe:2.3:o:extremenetworks:exos::::::::
	cpe:2.3:o:extremenetworks:exos::::::::

History

21 Nov 2024, 08:23

Type	Values Removed	Values Added
References	~~() https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114378 - Vendor Advisory~~	() https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114378 - Vendor Advisory

17 Sep 2024, 17:35

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-16 20:15

Updated : 2024-11-21 08:23

NVD link : CVE-2023-43119

Mitre link : CVE-2023-43119

CVE.ORG link : CVE-2023-43119

JSON object : View

Products Affected

extremenetworks

exos

CWE

CWE-863

Incorrect Authorization

CWE-284

Improper Access Control

{"id": "CVE-2023-43119", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-10-16T20:15:15.160", "references": [{"url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114378", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114378", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated privileges using crafted telnet commands via Redis server."}, {"lang": "es", "value": "Un problema de Control de Acceso descubierto en Extreme Networks Switch Engine (EXOS) anterior a 32.5.1.5, tambi\u00e9n solucionado en 22.7, 31.7.2, permite a los atacantes obtener privilegios aumentados utilizando comandos telnet manipulados a trav\u00e9s del servidor Redis."}], "lastModified": "2024-11-21T08:23:43.593", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:extremenetworks:exos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D24D6059-8005-487C-824A-DA558414E521", "versionEndExcluding": "22.7"}, {"criteria": "cpe:2.3:o:extremenetworks:exos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51484ECC-3B51-434F-8708-D5D914254A7D", "versionEndExcluding": "31.7.2", "versionStartIncluding": "31.7.0"}, {"criteria": "cpe:2.3:o:extremenetworks:exos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF47D6A6-2028-4547-A05E-EE9576AC557B", "versionEndExcluding": "32.5.1.5", "versionStartIncluding": "32.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

9.8 /10