CVE-2023-34131
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A vulnerability in SonicWall GMS and Analytics allows an unauthorized attacker to access restricted web pages. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Risk Assessment
Exposure of sensitive information may lead to unauthorized access to organizational data, increasing the risk of information leakage and potential attacks.
Recommendation
It is recommended to update to the latest versions of GMS and Analytics to mitigate the risk associated with this vulnerability.
Other vulnerabilities in SonicWall GMS i Analytics
See all- CVE-2023-34133High
CVE-2023-34133 describes an improper neutralization of special elements used in SQL commands, allowing an unauthenticated attacker to extract sensitive information from the SonicWall GMS and Analytics application database. This issue affects GMS versions 9.3.2-SP1 and earlier, and Analytics versions 2.5.0.4-R7 and earlier.
- CVE-2023-34132Critical
CVE-2023-34132 describes a vulnerability where the use of password hash instead of password for authentication in SonicWall GMS and Analytics allows for Pass-the-Hash attacks. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34129High
The 'Path Traversal' vulnerability in SonicWall GMS and Analytics allows an authenticated remote attacker to traverse directories and extract arbitrary files using the Zip Slip method, gaining access to the filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34128Critical
The Tomcat application credentials are hardcoded in the SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34135Medium
Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via web service. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34134Medium
CVE-2023-34134 describes a vulnerability that exposes sensitive information, allowing an authenticated attacker to read the administrator password hash via a web service call in SonicWall GMS and Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Original NVD description (English source)
Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker to access restricted web pages. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.