CVE-2023-6538
Last modified
CVE-2023-6538 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or combined Server+Storage administrative roles are able to access SMU configuration backup, that would normally be barred to those specific administrative roles. EPSS estimates a 1.58% chance of exploitation in the next 30 days.
Description
SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or combined Server+Storage administrative roles are able to access SMU configuration backup, that would normally be barred to those specific administrative roles.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hitachi | System Management Unit Firmware | < 14.8.7825.01 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-6538?
How severe is CVE-2023-6538?
How do I fix CVE-2023-6538?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-6531A use-after-free flaw was found in the Linux Kernel due to a…7
- CVE-2023-6532The WP Blogs' Planetarium WordPress plugin through 1.0 does …8.8
- CVE-2023-6533Malformed Device Reset Locally Command Class packets can be …6.5
- CVE-2023-6534In versions of FreeBSD 14.0-RELEASE before 14-RELEASE-p2, Fr…7.5
- CVE-2023-6535A flaw was found in the Linux kernel's NVMe driver. This iss…7.5
- CVE-2023-6536A flaw was found in the Linux kernel's NVMe driver. This iss…7.5
- CVE-2023-6540A vulnerability was reported in the Lenovo Browser Mobile an…7.5
- CVE-2023-6541The Allow SVG WordPress plugin before 1.2.0 does not sanitiz…6.1
- CVE-2023-6542Due to lack of proper authorization checks in Emarsys SDK fo…7.1
- CVE-2023-6544A flaw was found in the Keycloak package. This issue occurs …5.4
- CVE-2023-6545The package authelia-bhf included in Beckhoffs TwinCAT/BSD i…4.7
- CVE-2023-6546A race condition was found in the GSM 0710 tty multiplexor i…7
Are you affected by CVE-2023-6538?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST