CVE-2023-6538
System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products is susceptible to unintended information disclosure via unprivileged access to SMU configuration backup data.
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or combined Server+Storage administrative roles are able to access SMU configuration backup, that would normally be barred to those specific administrative roles.
Las versiones de SMU anteriores a 14.8.7825.01 son susceptibles a la divulgación de información no intencionada mediante la manipulación de URL. Los usuarios autenticados en funciones administrativas de Almacenamiento, Servidor o combinadas de Servidor+Almacenamiento pueden acceder a la copia de seguridad de la configuración de SMU, que normalmente estaría prohibida para esas funciones administrativas específicas.
Hitachi NAS (HNAS) System Management Unit (SMU) version 14.8.7825 suffers from an information disclosure vulnerability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-12-05 CVE Reserved
- 2023-12-11 CVE Published
- 2023-12-18 First Exploit
- 2024-08-02 CVE Updated
- 2024-10-06 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-285: Improper Authorization
CAPEC
- CAPEC-37: Retrieve Embedded Sensitive Data
References (3)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://www.exploit-db.com/exploits/51915 | 2024-03-20 | |
https://github.com/Arszilla/CVE-2023-6538 | 2023-12-18 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Hitachi Search vendor "Hitachi" | System Management Unit Firmware Search vendor "Hitachi" for product "System Management Unit Firmware" | < 14.8.7825.01 Search vendor "Hitachi" for product "System Management Unit Firmware" and version " < 14.8.7825.01" | - |
Affected
| in | Hitachi Search vendor "Hitachi" | System Management Unit Search vendor "Hitachi" for product "System Management Unit" | - | - |
Safe
|