Lucene search

DIVDCVELIST:CVE-2023-22581

HistoryApr 24, 2023 - 8:14 a.m.

CVE-2023-22581 White Rabbit Switch - Unauthenticated remote code execution

2023-04-2408:14:53

CWE-20

DIVD

www.cve.org

cve-2023-22581

white rabbit switch

vulnerability

unauthenticated

remote code execution

web application

root user

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

67.8%

JSON

White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application (the default installation makes the webserver run as the root user).

CNA Affected

[
  {
    "vendor": "CERN",
    "product": "White Rabbit Switch",
    "versions": [
      {
        "status": "affected",
        "version": "< v6.0.1",
        "lessThanOrEqual": "v6.0.1",
        "versionType": "v.x.y.z"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

csirt.divd.nl/CVE-2023-22581/

csirt.divd.nl/DIVD-2022-00068/

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

67.8%

JSON

Related for CVELIST:CVE-2023-22581