CVE-2023-28461 - OpenCVE

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Arraynetworks	Ag1500fips Arrayos Ag Ag1200v5 Ag1100v5 Ag1000v5 Ag1000 Ag1500 Ag1200 Ag1500v5 Ag1600 Vxag Ag1000t Ag1600v5 Ag1150

Configuration 1 [-]

AND

cpe:2.3:o:arraynetworks:arrayos_ag:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:arraynetworks:ag1000:-:::::::*
	cpe:2.3:h:arraynetworks:ag1000t:-:::::::*
	cpe:2.3:h:arraynetworks:ag1000v5:-:::::::*
	cpe:2.3:h:arraynetworks:ag1100v5:-:::::::*
	cpe:2.3:h:arraynetworks:ag1150:-:::::::*
	cpe:2.3:h:arraynetworks:ag1200:-:::::::*
	cpe:2.3:h:arraynetworks:ag1200v5:-:::::::*
	cpe:2.3:h:arraynetworks:ag1500:-:::::::*
	cpe:2.3:h:arraynetworks:ag1500fips:-:::::::*
	cpe:2.3:h:arraynetworks:ag1500v5:-:::::::*
	cpe:2.3:h:arraynetworks:ag1600:-:::::::*
	cpe:2.3:h:arraynetworks:ag1600v5:-:::::::*
	cpe:2.3:h:arraynetworks:vxag:-:::::::*

References

Link	Resource
https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf	Mitigation Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2023-03-15T00:00:00

Updated: 2023-03-15T00:00:00

Reserved: 2023-03-15T00:00:00

Link: CVE-2023-28461

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-03-15T23:15:10.070

Modified: 2023-03-24T14:57:23.997

Link: CVE-2023-28461

JSON object: View

Redhat Information

No data.

CWE

CWE-287

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:arraynetworks:arrayos_ag:*:*:*:*:*:*:*:*", "matchCriteriaId": "D704D079-D1AF-40EA-98E7-BE1E01371B11", "versionEndIncluding": "9.4.0.481", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:arraynetworks:ag1000:-:*:*:*:*:*:*:*", "matchCriteriaId": "EBE11A77-8C2F-46CA-87BA-47624380FFC1", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:ag1000t:-:*:*:*:*:*:*:*", "matchCriteriaId": "5ED51E1F-3155-40C6-B61C-73D6A9F64987", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:ag1000v5:-:*:*:*:*:*:*:*", "matchCriteriaId": "F0BC33CF-FA0B-4556-B11E-61FF9B14880A", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:ag1100v5:-:*:*:*:*:*:*:*", "matchCriteriaId": "A9C8C9AE-AF59-4E5A-93CD-A394F1A31FA0", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:ag1150:-:*:*:*:*:*:*:*", "matchCriteriaId": "5E025A9D-6B7C-42B6-95EA-0A5726A919F4", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:ag1200:-:*:*:*:*:*:*:*", "matchCriteriaId": "0771D54C-15DF-403C-8CFA-B1E7D0136F50", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:ag1200v5:-:*:*:*:*:*:*:*", "matchCriteriaId": "7C9F6B87-E3D2-419A-B086-B981EF912F80", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:ag1500:-:*:*:*:*:*:*:*", "matchCriteriaId": "D385DBD0-C4A9-4168-82C2-832E0E40F42D", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:ag1500fips:-:*:*:*:*:*:*:*", "matchCriteriaId": "01569AB3-736D-47FE-86DD-F08ACDDCD11E", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:ag1500v5:-:*:*:*:*:*:*:*", "matchCriteriaId": "22E45185-071F-414A-AF78-4739F15A1D93", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:ag1600:-:*:*:*:*:*:*:*", "matchCriteriaId": "C6F0988E-5E75-486A-9229-956D38A51C35", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:ag1600v5:-:*:*:*:*:*:*:*", "matchCriteriaId": "1D09E2CC-C1B5-40DC-AD1A-7C6AB20525DC", "vulnerable": false}, {"criteria": "cpe:2.3:h:arraynetworks:vxag:-:*:*:*:*:*:*:*", "matchCriteriaId": "6E149796-E3D7-4FAF-AB64-8D273E701861", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated \"a new Array AG release with the fix will be available soon.\""}], "id": "CVE-2023-28461", "lastModified": "2023-03-24T14:57:23.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-03-15T23:15:10.070", "references": [{"source": "cve@mitre.org", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}