Lucene search

DellCVE-2023-43082

HistoryNov 22, 2023 - 5:15 p.m.

CVE-2023-43082

2023-11-2217:15:18

CWE-295

dell

web.nvd.nist.gov

cve-2023-43082

dell unity

vulnerability

man in the middle

vmadapter

certificate spoofing

nvd

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

24.2%

JSON

Dell Unity prior to 5.3 contains a ‘man in the middle’ vulnerability in the vmadapter component. If a customer has a certificate signed by a third-party public Certificate Authority, the vCenter CA could be spoofed by an attacker who can obtain a CA-signed certificate.

Affected configurations

Nvd

Vulners

Node

dellunity_operating_environmentRange<5.3.0.0.5.120

dellunity_xt_operating_environmentRange<5.3.0.0.5.120

dellunityvsa_operating_environmentRange<5.3.0.0.5.120

VendorProductVersionCPE
dellunity_operating_environment*cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:*
dellunity_xt_operating_environment*cpe:2.3:a:dell:unity_xt_operating_environment:*:*:*:*:*:*:*:*
dellunityvsa_operating_environment*cpe:2.3:a:dell:unityvsa_operating_environment:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	unity_operating_environment	*	cpe:2.3:a:dell:unity_operating_environment::::::::
dell	unity_xt_operating_environment	*	cpe:2.3:a:dell:unity_xt_operating_environment::::::::
dell	unityvsa_operating_environment	*	cpe:2.3:a:dell:unityvsa_operating_environment::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Unity",
    "vendor": "Dell",
    "versions": [
      {
        "status": "affected",
        "version": "Versions prior to 5.3.0.0.5.120"
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

24.2%

JSON

Related for CVE-2023-43082