PT-2023-20231 · Nozomi Networks · Nozomi Networks Guardian+1

Mostafa Soliman · Publicado 2023-09-19 · Atualizado 2024-09-30 · CVE-2023-2567

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nozomi Networks Guardian and CMC (affected versions not specified)

Description A SQL Injection issue has been found due to improper input validation in certain parameters used in the Query functionality. Authenticated users may be able to execute arbitrary SQL statements on the DBMS used by the web application, allowing them to extract arbitrary information from the DBMS in an uncontrolled way.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-2567

Produtos afetados

Nozomi Networks Cmc

Nozomi Networks Guardian

Referências · 9

• https://security.nozominetworks.com/NN-2023:9-01 · Aviso do Fabricante
• https://t.me/cvenotify/81154 · Publicação no Telegram
• https://t.me/cibsecurity/70702 · Publicação no Telegram
• https://t.me/cvenotify/58336 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1704081176103883224 · Publicação no Twitter
• https://twitter.com/cracbot/status/1704374877581607045 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-2567 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-2567 · Aviso do Fabricante
• https://t.me/cvenotify/95414 · Publicação no Telegram