CVE-2023-5808

HIGH

System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products are susceptible to unintended information disclosure via unprivileged access to HNAS configuration backup and diagnostic data.

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-5808 has a selected CVSS score of 7.6 (high); EIP currently links 1 repository PoC.

Description

SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrative role are able to access HNAS configuration backup and diagnostic data, that would normally be barred to that specific administrative role.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 28, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

System Management Unit (SMU)

Browse Hitachi Vantara / System Management Unit (SMU)

Default status: unaffected

CVE List6.0 to < 14.8.7825.01affected

system_management_unit

Browse hitachi_vantara / system_management_unit

Default status: unknown

CVE List6.0 to < 14.8.7825.01affected

Proofs of concept

1

Repository PoCs

GitHubArszilla/CVE-2023-5808Repository PoCby Arszilla2Not analyzed3 files

46.5 KiB

GitHub
PoC details

References

4