CVE-2023-5973 Truncated port name

What is CVE-2023-5973?

CVE-2023-5973 is a medium-severity cross-site scripting vulnerability in Broadcom Fabric Operating System, published on 5 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Brocade Web Interface in Brocade Fabric OS v9.x and before v9.2.0 does not properly represent the portName to the user if the portName contains reserved characters. This could allow an authenticated user to alter the UI of the Brocade Switch and change ports display.

Weakness: CWE-346

Which versions are affected by CVE-2023-5973?

It affects 1 product.

Products include Broadcom Fabric Operating System.

How do I fix CVE-2023-5973?

No fix has been published for CVE-2023-5973 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-5973 being exploited?

There is no known exploitation of CVE-2023-5973 in the wild and no public exploit code.

Other vulnerabilities in Broadcom Fabric Operating System

• CVE-2025-1976 Broadcom Brocade Fabric OS Code Injection Exploited High 8.6
• CVE-2021-22555 Linux Kernel Heap Out-of-Bounds Write Exploited High 8.3
• CVE-2022-33186 Command injection in Brocade Fabric OS Critical 9.8
• CVE-2021-27797 Hardcoded credentials in Brocade Fabric OS Critical 9.8
• CVE-2020-15371 Code injection in Brocade Fabric OS Critical 9.8

All Broadcom Fabric Operating System vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mq9r-62m5-pjc2.