CVE-2023-34329 CRITICAL

CVE-2023-34329: Authentication Bypass via HTTP Header Spoofing

Vendor Ami

Product MegaRAC_SPx12

Weakness CWE-306 · Missing auth

Published July 18, 2023

Last update February 13, 2025

View on NVD All CVEs

CVSS base score

9.1/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

AMI MegaRAC SPx12 contains a vulnerability in BMC where a User may cause an authentication bypass by spoofing the HTTP header. A successful exploit of this vulnerability may lead to loss of confidentiality, integrity, and availability.

Key dates

02Disclosure timeline

July 18, 2023 CVE published

February 13, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-34329 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html

Related vulnerabilities

04Related CVE

CVE-2024-5910 Expedition: Missing Authentication Leads to Admin Account Takeover CVE-2018-25134 Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass via webNewAcct.cgi CVE-2024-45356 Xiaomi phone framework has unauthorized access vulnerability CVE-2023-37325 D-Link DAP-2622 DDP Set SSID List Missing Authentication Vulnerability CVE-2026-42864 FireFighter: Unauthenticated SSRF in Raid jira_bot endpoint allows IAM credential theft