CVE-2023-34129
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
The 'Path Traversal' vulnerability in SonicWall GMS and Analytics allows an authenticated remote attacker to traverse directories and extract arbitrary files using the Zip Slip method, gaining access to the filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Risk Assessment
An attacker could access sensitive data on the filesystem, potentially leading to serious security breaches and data loss within the organization.
Recommendation
It is recommended to upgrade to the latest versions of SonicWall GMS and Analytics to mitigate this vulnerability and to conduct a security audit of the system.
Original NVD description (English source)
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authenticated remote attacker to traverse the directory and extract arbitrary files using Zip Slip method to any location on the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.