CVE-2023-6070

—

CVSS 3.1

4.3 medium

EPSS

<1%p16

Published

Nov 29, 2023 (Nov 29, 2023)

Modified

Jun 17, 2026

Description

A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data

Vendors: trellix
Products: enterprise security manager
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.