Skip to content
Sign in
4.3 Medium

CVE-2023-6070 A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to…

Description

A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data

Affected products and versions

Product Affected versions Fixed in
Trellix Enterprise Security Manager (ESM) 11.6.8 No fix stated

Other CVEs of Trellix Enterprise Security Manager (ESM)

The 3 CVEs of Trellix Enterprise Security Manager (ESM) →
CVE-2024-11482 A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code… 9.8 Critical CVE-2024-11481 A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API 8.2 High
Track this CVE