HIGH🇵🇱 Wersja polska

CVE-2023-34198

CVSS 7.3v3.1pub. 2024-02-29upd. 2025-02-14

In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a Network object created from an inactive DHCP interface in the filtering slot results in the usage of an object of the :any" type, which may have unexpected results for access control.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

  • Stormshield Network Security

    APP
    Stormshield
    4.7.01.0.0 – 3.7.37 (excl.)3.8.0 – 3.11.25 (excl.)4.0.0 – 4.3.19 (excl.)4.4.0 – 4.6.6 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-20032CRITICAL9.8PL ✓same product

ClamAV: RCE przez buffer overflow w parserze partycji HFS+

CVE-2022-37434CRITICAL9.8PL ✓same product

Buffer overflow w zlib podczas przetwarzania nagłówka gzip (inflate)

CVE-2021-31617CRITICAL9.8PL ✓same product

RCE w Stormshield Network Security — błąd zarządzania pamięcią w ASQ

CVE-2020-7465CRITICAL9.8PL ✓same product

RCE/DoS w implementacji L2TP projektu MPD — błąd zapisu poza buforem

CVE-2025-48707HIGH7.5same product

An issue was discovered in Stormshield Network Security (SNS) before 5.0.1. TPM authentication information cou...