Lucene search

NozomiVULNRICHMENT:CVE-2023-24015

HistoryAug 09, 2023 - 9:05 a.m.

CVE-2023-24015 Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2

2023-08-0909:05:16

CWE-1286

Nozomi

github.com

cve-2023-24015

dos

reports section

guardian/cmc

exploitable

authenticated user

stuck on loading

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:N/SI:N/VA:L/SA:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

29.2%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null.

The reports section will be partially unavailable for all later attempts to use it, with the report list seemingly stuck on loading.

References

security.nozominetworks.com/NN-2023:6-01

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:N/SI:N/VA:L/SA:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

29.2%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-24015