Cyber Resilience

CVE-2023-1995

Medium

Published: 29 August 2023

Published
29 August 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0021 43.7th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-1995 is a medium-severity Insufficient Logging (CWE-778) vulnerability in Hitachi Hirdb Server. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 43.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Insufficient Logging vulnerability in Hitachi HiRDB Server, HiRDB Server With Addtional Function, HiRDB Structured Data Access Facility.This issue affects HiRDB Server: before 09-60-39, before 09-65-23, before 09-66-17, before 10-01-10, before 10-03-12, before 10-04-06, before 10-05-06, before 10-06-02; HiRDB Server With…

more

Addtional Function: before 09-60-2M, before 09-65-/W , before 09-66-/Q ; HiRDB Structured Data Access Facility: before 09-60-39, before 10-03-12, before 10-04-06, before 10-06-02.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

hitachi
hirdb server with additional function
09-00 — 09-00-2d · 09-01 — 09-01-\/x · 09-02 — 09-02-2f
hitachi
hirdb structured data access facility
09-60 — 09-60-37 · 09-66 — 09-66-06 · 10-01 — 10-01-03
hitachi
hirdb server
09-00 — 09-00-30 · 09-01 — 09-01-24 · 09-02 — 09-02-32

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-778

Audit policy requires defining and implementing logging of security-relevant events, directly reducing insufficient logging.

addresses: CWE-778

Providing proof of performed actions necessitates sufficient logging of security-relevant events with attribution details.

addresses: CWE-778

Retaining audit records for a defined period ensures security-relevant events remain available for after-the-fact investigations, directly mitigating the risk that attackers can hide actions due to missing or purged log data.

addresses: CWE-778

Directly requires generation of audit records for specified events, preventing the absence of logging that allows undetected malicious activity.

addresses: CWE-778

Directly implements detailed session logging to address the weakness of insufficient logging.

addresses: CWE-778

Provides alternate logging mechanism to maintain audit trails when primary capability fails, directly reducing insufficient logging.

addresses: CWE-778

Employing coordination mechanisms ensures consistent and sufficient logging practices are applied when audit information crosses organizational boundaries.

addresses: CWE-778

This control requires identifying, specifying, and justifying event types for logging with a focus on adequacy for post-incident investigations, directly mitigating insufficient logging.

References