CVE-2023-27879

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	Intel(R) Optane(TM) SSD products	See references

References

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00758.htmlVendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00758.htmlVendor Advisory

Timeline

Published: Nov 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-27886.5Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to ret CVE-2023-278819.9A user could use the “Upload Resource” functionality to upload files to any location on the disk.CVE-2023-278829.8A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A spec CVE-2023-278869.8Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. This can be exploited to inject CVE-2023-278874.4Improper initialization in BIOS firmware for some Intel(R) NUCs may allow a privileged user to potentially enable information disclosure via CVE-2023-278885.4Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script v CVE-2023-278898.8Cross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to h CVE-2023-27897.5A vulnerability was found in GNU cflow 1.7. It has been rated as problematic. This issue affects the function func_body/parse_variable_decla CVE-2023-278905.4The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User CVE-2023-278917.5rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.CVE-2023-278925.7Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messag CVE-2023-278938.8An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and A