CVE-2023-5648: XSS
In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Brocade ASCGto a version that resolves this vulnerability.Fixed in 3.0
Event History
Frequently Asked Questions
Which deployments are affected?
Brocade ASCG versions before v3.0 are affected. The issue applies to various ASCG URL paths where security-related HTTP headers are missing.
Does exploitation require authentication or user interaction?
An attacker does not need authentication, but exploitation requires user interaction. The reported attack scenarios include cross-site scripting, clickjacking, and information disclosure.
What is the remediation?
Upgrade Brocade ASCG to v3.0 or later. The provided information does not identify a configuration workaround for systems that cannot yet be upgraded.