PT-2023-5523 · Nozomi · Nozomi Guardian+1

Stefano Libero · Published 2023-01-24 · Updated 2024-09-20 · CVE-2023-22843

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions Nozomi Guardian and Nozomi Central Management Console (CMC) (affected versions not specified)

Description An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, which will be stored and can later be executed by another legitimate user viewing the details of such a rule. This allows an attacker to perform unauthorized actions on behalf of legitimate users and/or gather sensitive information. JavaScript injection is possible in the contents for Yara rules, while limited HTML injection has been proven for packet and STYX rules.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-06173

CVE-2023-22843

Affected Products

Nozomi Central Management Console

Nozomi Guardian

References · 9

• https://security.nozominetworks.com/NN-2023:4-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22843 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22843 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06173 · Security Note
• https://t.me/cvenotify/81148 · Telegram Post
• https://vuldb.com/?id.236641 · Note
• https://t.me/cvenotify/95399 · Telegram Post
• https://t.me/cibsecurity/68074 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1689225566551986177 · Twitter Post