CRITICAL🇵🇱 Wersja polska

CVE-2023-34132

CVSS 9.8v3.1pub. 2023-07-13upd. 2024-11-21

Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sonicwall Analytics

    APP
    Sonicwall
    ≤ 2.5.0.4-r7

  • Sonicwall Global Management System

    APP
    Sonicwall
    9.3.2< 9.3.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-34136CRITICAL9.8PL ✓same product

SonicWall GMS/Analytics — nieautoryzowane przesyłanie plików (CWE-434)

CVE-2023-34124CRITICAL9.8PL ✓same product

SonicWall GMS i Analytics — authentication bypass w Web Services

CVE-2023-34128CRITICAL9.8PL ✓same product

Hardcodowane dane uwierzytelniające Tomcat w SonicWall GMS i Analytics

CVE-2023-34130CRITICAL9.8PL ✓same product

SonicWall GMS i Analytics — słabe szyfrowanie TEA z zakodowanym kluczem

CVE-2023-34137CRITICAL9.8PL ✓same product

SonicWall GMS i Analytics — pominięcie uwierzytelnienia przez statyczne wartości