Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."
Metrics
Affected Vendors & Products
References
History
Mon, 02 Dec 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
kev
|
Mon, 25 Nov 2024 18:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Weaknesses | CWE-862 |
Mon, 25 Nov 2024 18:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
kev
|
Mon, 25 Nov 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Weaknesses | CWE-306 |
Mon, 25 Nov 2024 16:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Weaknesses | CWE-862 | |
CPEs | cpe:2.3:o:arraynetworks:arrayos_ag:-:*:*:*:*:*:*:* | |
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2023-03-15T00:00:00
Updated: 2024-12-02T16:45:16.947Z
Reserved: 2023-03-15T00:00:00
Link: CVE-2023-28461
Vulnrichment
Updated: 2024-08-02T12:38:25.279Z
NVD
Status : Modified
Published: 2023-03-15T23:15:10.070
Modified: 2024-12-02T17:15:05.133
Link: CVE-2023-28461
Redhat
No data.