CVE-2023-6070

A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data

Score

CVSS 3.1 4.3 Medium

Status

Modified - trellixpsirt@trellix.com

Published

2023-11-29

Last modified

2024-10-11

Weaknesses

CWE-918

Affected products

• Enterprise Security Manager (Trellix)
• Trellix Enterprise Security Manager Esm (Trellix)

References

• https://kcm.trellix.com/corporate/index?page=content&id=SB10413