CVE-2023-43070 Path traversal in Dell SmartFabric Storage Software

Medium 6.3 Published 5 Oct 2023 Updated 19 Sep 2024

A remote authenticated attacker can exploit a path traversal vulnerability to modify or write arbitrary files in the license container.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-43070?

CVE-2023-43070 is a medium-severity path traversal vulnerability in Dell SmartFabric Storage Software, published on 5 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Dell SmartFabric Storage Software v1.4 (and earlier) contains a Path Traversal Vulnerability in the HTTP interface. A remote authenticated attacker could potentially exploit this vulnerability, leading to modify or write arbitrary files to arbitrary locations in the license container.

Weakness: CWE-22

Which versions are affected by CVE-2023-43070?

It affects 1 product.

Products include Dell Smartfabric Storage Software.

How do I fix CVE-2023-43070?

No fix has been published for CVE-2023-43070 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-43070 being exploited?

There is no known exploitation of CVE-2023-43070 in the wild and no public exploit code.

Sources

Also known as GHSA-w942-69h2-4pj6.