Summary
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in SonicWall GMS und SonicWall Analytics ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern und Daten zu manipulieren.
Product
Das SonicWall Global Management System (GMS) dient der zentralen Verwaltung von SonicWall Firewalls.
SonicWall Analytics ergänzt die SonicWall-Firewall-Produkte, indem es eine erweiterte Sichtbarkeit und Analyse der von den Firewalls generierten Netzwerkverkehrsdaten ermöglicht und so die Fähigkeiten zur Erkennung von und Reaktion auf Bedrohungen verbessert.
Vulnerabilities 15
-
Critical 9.8
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticati…
-
High 8.8
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall G…
-
High 7.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and…
-
Unscored —
Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics. This issue affects GMS: 9.3.2-…
-
Unscored —CVE-2023-34125 EPSS 24%
Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the und…
-
Unscored —
Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesys…
-
Unscored —
Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS:…
-
Unscored —CVE-2023-34129 EPSS 41%
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analy…
-
Unscored —
SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data…
-
Unscored —
Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unau…
-
Unscored —CVE-2023-34132 Public exploit
Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-th…
-
Unscored —
Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenti…
-
Unscored —
Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary fi…
-
Unscored —
Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location n…
-
Unscored —
SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks lea…
Revision history
-
#1
Initiale Fassung
References
-
SonicWall Security Advisory vom 2023-07-12
https://www.sonicwall.com/support/knowledge-base/urgent-security-notice-sonicwall-gms-analytics-impacted-by-suite-of-vulnerabilities/230710150218060/
-
SonicWall Security Advisory vom 2023-07-12
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010