CRITICAL🇵🇱 Wersja polska

CVE-2023-34137

CVSS 9.8v3.1pub. 2023-07-13upd. 2024-11-21

SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sonicwall Analytics

    APP
    Sonicwall
    ≤ 2.5.0.4-r7

  • Sonicwall Global Management System

    APP
    Sonicwall
    9.3.2< 9.3.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2023-34132CRITICAL9.8PL ✓same product

SonicWall GMS/Analytics — podatność Pass-the-Hash w uwierzytelnianiu

CVE-2023-34124CRITICAL9.8PL ✓same product

SonicWall GMS i Analytics — authentication bypass w Web Services

CVE-2023-34128CRITICAL9.8PL ✓same product

Hardcodowane dane uwierzytelniające Tomcat w SonicWall GMS i Analytics

CVE-2023-34130CRITICAL9.8PL ✓same product

SonicWall GMS i Analytics — słabe szyfrowanie TEA z zakodowanym kluczem

CVE-2023-34136CRITICAL9.8PL ✓same product

SonicWall GMS/Analytics — nieautoryzowane przesyłanie plików (CWE-434)