« Volver al listado

CVE-2023-43118

Estado: ModificadaAlta (8.8)—

Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Extremenetworks — Exos

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-43118",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-43118",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-17T16:20:02.433233Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-10-16T20:15:15.100",
  "references": [
    {
      "url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114379",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114379",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross Site Request Forgery (CSRF) vulnerability in Chalet application in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, fixed in 31.7.2 and 32.5.1.5 allows attackers to run arbitrary code and cause other unspecified impacts via /jsonrpc API."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Cross Site Request Forgery (CSRF) en la aplicación Chalet en Extreme Networks Switch Engine (EXOS) anterior a 32.5.1.5, corregida en 31.7.2 y 32.5.1.5, permite a los atacantes ejecutar código arbitrario y causar otros impactos no especificados a través de la API /jsonrpc."
    }
  ],
  "lastModified": "2026-06-17T06:25:07.770",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:extremenetworks:exos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51484ECC-3B51-434F-8708-D5D914254A7D",
              "versionEndExcluding": "31.7.2",
              "versionStartIncluding": "31.7.0"
            },
            {
              "criteria": "cpe:2.3:o:extremenetworks:exos:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF47D6A6-2028-4547-A05E-EE9576AC557B",
              "versionEndExcluding": "32.5.1.5",
              "versionStartIncluding": "32.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}