PT-2023-3806 · Sonicwall · Sonicwall Analytics+1

Published 2023-07-12 · Updated 2023-10-18 · CVE-2023-34131

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SonicWall GMS versions 9.3.2-SP1 and earlier SonicWall Analytics versions 2.5.0.4-R7 and earlier

Description The issue is related to the exposure of sensitive information to unauthorized actors in SonicWall GMS and Analytics, allowing an unauthenticated attacker to access restricted web pages. This is due to a lack of protection for service data, which can be exploited by a remote attacker to gain unauthorized access to protected information.

Recommendations For SonicWall GMS versions 9.3.2-SP1 and earlier, update to a version later than 9.3.2-SP1 to resolve the issue. For SonicWall Analytics versions 2.5.0.4-R7 and earlier, update to a version later than 2.5.0.4-R7 to resolve the issue. As a temporary workaround, consider restricting access to the affected web pages until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-04098

CVE-2023-34131

Affected Products

Sonicwall Analytics

Sonicwall Gms

References · 8

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010 · Vendor Advisory
• https://sonicwall.com/support/notices/230710150218060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34131 · Security Note
• https://bdu.fstec.ru/vul/2023-04098 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34131 · Vendor Advisory
• https://twitter.com/fletch_ai/status/1714870750220333304 · Twitter Post
• https://t.me/cvenotify/54212 · Telegram Post
• https://t.me/cibsecurity/66622 · Telegram Post