CVE-2023-22378

2023-08-0909:15:13

CWE-89

[email protected]

web.nvd.nist.gov

sql injection

nozomi networks

input validation

authenticated user

dbms

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

28.3%

JSON

A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application.

Authenticated users may be able to extract arbitrary information from the DBMS in an uncontrolled way, alter its structure and data, and/or affect its availability.

Affected configurations

Nvd

Node

nozominetworkscmcRange<22.6.2

nozominetworksguardianRange<22.6.2

VendorProductVersionCPE
nozominetworkscmc*cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:*
nozominetworksguardian*cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*