Lucene search

SonicwallCVE-2023-34125

HistoryJul 13, 2023 - 1:15 a.m.

CVE-2023-34125

2023-07-1301:15:08

CWE-27

CWE-22

sonicwall

web.nvd.nist.gov

In Wild

cve-2023-34125

path traversal

gms

analytics

vulnerability

authenticated attacker

filesystem

root privileges

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

29.9%

JSON

Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

Affected configurations

Nvd

Node

sonicwallanalyticsRange≤2.5.0.4-r7

sonicwallglobal_management_systemRange<9.3.2

sonicwallglobal_management_systemMatch9.3.2-

sonicwallglobal_management_systemMatch9.3.2sp1

VendorProductVersionCPE
sonicwallanalytics*cpe:2.3:a:sonicwall:analytics:*:*:*:*:*:*:*:*
sonicwallglobal_management_system*cpe:2.3:a:sonicwall:global_management_system:*:*:*:*:*:*:*:*
sonicwallglobal_management_system9.3.2cpe:2.3:a:sonicwall:global_management_system:9.3.2:-:*:*:*:*:*:*
sonicwallglobal_management_system9.3.2cpe:2.3:a:sonicwall:global_management_system:9.3.2:sp1:*:*:*:*:*:*

Vendor	Product	Version	CPE
sonicwall	analytics	*	cpe:2.3:a:sonicwall:analytics::::::::
sonicwall	global_management_system	*	cpe:2.3:a:sonicwall:global_management_system::::::::
sonicwall	global_management_system	9.3.2	cpe:2.3:a:sonicwall:global_management_system:9.3.2:-::::::
sonicwall	global_management_system	9.3.2	cpe:2.3:a:sonicwall:global_management_system:9.3.2:sp1::::::

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "GMS",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "9.3.2-SP1 and earlier versions"
      }
    ]
  },
  {
    "defaultStatus": "unknown",
    "product": "Analytics",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "2.5.0.4-R7 and earlier versions"
      }
    ]
  }
]

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010

www.sonicwall.com/support/notices/230710150218060

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

29.9%

JSON

Related for CVE-2023-34125