PT-2023-3804 · Sonicwall · Sonicwall Analytics+1

Publicado

2023-07-12

·

Atualizado

2025-10-14

·

CVE-2023-34133

CVSS v2.0

7.8

Alta

VetorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions SonicWall GMS versions 9.3.2-SP1 and earlier SonicWall Analytics versions 2.5.0.4-R7 and earlier
Description The issue is related to improper neutralization of special elements used in an SQL command, allowing an unauthenticated attacker to extract sensitive information from the application database. This is a SQL Injection vulnerability.
Recommendations For SonicWall GMS versions 9.3.2-SP1 and earlier, update to a version later than 9.3.2-SP1 to resolve the issue. For SonicWall Analytics versions 2.5.0.4-R7 and earlier, update to a version later than 2.5.0.4-R7 to resolve the issue. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2023-04096
CVE-2023-34133

Produtos afetados

Sonicwall Analytics
Sonicwall Gms