Lucene search

MitreCVE-2023-43118

HistoryOct 16, 2023 - 8:15 p.m.

CVE-2023-43118

2023-10-1620:15:15

CWE-352

mitre

web.nvd.nist.gov

cve-2023-43118

csrf

chalet application

extreme networks

switch engine

exos

api

jsonrpc

vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

24.2%

JSON

Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API.

Affected configurations

Nvd

Node

extremenetworksexosRange31.7.0–31.7.2

extremenetworksexosRange32.0–32.5.1.5

VendorProductVersionCPE
extremenetworksexos*cpe:2.3:o:extremenetworks:exos:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
extremenetworks	exos	*	cpe:2.3:o:extremenetworks:exos::::::::

References

extreme-networks.my.site.com/ExtrArticleDetail?an=000114379

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

24.2%

JSON

Related for CVE-2023-43118