PT-2023-20231 · Nozomi Networks · Nozomi Networks Guardian+1

Mostafa Soliman · Published 2023-09-19 · Updated 2024-09-30 · CVE-2023-2567

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nozomi Networks Guardian and CMC (affected versions not specified)

Description A SQL Injection issue has been found due to improper input validation in certain parameters used in the Query functionality. Authenticated users may be able to execute arbitrary SQL statements on the DBMS used by the web application, allowing them to extract arbitrary information from the DBMS in an uncontrolled way.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-2567

Affected Products

Nozomi Networks Cmc

Nozomi Networks Guardian

References · 9

• https://security.nozominetworks.com/NN-2023:9-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2567 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2567 · Vendor Advisory
• https://t.me/cvenotify/81154 · Telegram Post
• https://t.me/cibsecurity/70702 · Telegram Post
• https://t.me/cvenotify/58336 · Telegram Post
• https://twitter.com/CVEnew/status/1704081176103883224 · Twitter Post
• https://twitter.com/cracbot/status/1704374877581607045 · Twitter Post
• https://t.me/cvenotify/95414 · Telegram Post