CVE-2023-6070

Published: Nov 29, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data

Affected (1)

Products: Trellix: Enterprise Security Manager

1 product

Enterprise Security Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Trellix Enterprise Security Manager	Before 11.6.8

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://kcm.trellix.com/corporate/index?page=content&id=SB10413

Source: trellixpsirt@trellix.com

Vendor Advisory

https://kcm.trellix.com/corporate/index?page=content&id=SB10413

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.