// For flags

CVE-2023-5808

System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products are susceptible to unintended information disclosure via unprivileged access to HNAS configuration backup and diagnostic data.

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrative role are able to access HNAS configuration backup and diagnostic data, that would normally be barred to that specific administrative role.

La divulgación de información en SMU en Hitachi Vantara HNAS 14.8.7825.01 en Windows permite a los usuarios autenticados descargar archivos confidenciales a través de Insecure Direct Object Reference (IDOR).

Hitachi NAS SMU Backup and Restore versions prior to 14.8.7825.01 suffer from an insecure direct object reference vulnerability.

*Credits: Arslan Masood
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2023-10-26 CVE Reserved
  • 2023-12-04 CVE Published
  • 2023-12-09 EPSS Updated
  • 2023-12-18 First Exploit
  • 2024-08-28 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-285: Improper Authorization
  • CWE-287: Improper Authentication
CAPEC
  • CAPEC-37: Retrieve Embedded Sensitive Data
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hitachi
Search vendor "Hitachi"
 Vantara Hitachi Network Attached Storage
Search vendor "Hitachi" for product "Vantara Hitachi Network Attached Storage"
 <= 14.8.7825.01
Search vendor "Hitachi" for product "Vantara Hitachi Network Attached Storage" and version " <= 14.8.7825.01"
-
Affected
in Microsoft
Search vendor "Microsoft"
 Windows
Search vendor "Microsoft" for product "Windows"
--
Safe