CVE-2023-4338 - Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers

Back Back to CVE browser

CRITICAL

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers

Published Aug 15, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.70%

Description

Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers

Affected products

Vendor Broadcom Product LSI Storage Authority (LSA) Default
affected
- Version
  0
  Status
  affected
  Constraints
  <7.017.011.000
Vendor Intel Product RAID Web Console 3 (RWC3) Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <7.017.011.000

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Broadcom

LSI Storage Authority (LSA)

affected

Version	Status	Constraints
0	affected	<7.017.011.000

Intel

RAID Web Console 3 (RWC3)

unaffected

Version	Status	Constraints
0	affected	<7.017.011.000

Remediation

Vendor solution

This issue is fixed in 7.017.011.000. For more information please contact your Broadcom representative.

Weaknesses (0)

No CWE recorded.

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54203		Advisory
https://www.broadcom.com/support/resources/product-security-center		Product
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html