CVE-2023-34133

HighCVSS 7.5

Published: 13/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

77.03%

99th percentile - higher than 99% of all known CVEs

Summary

CVE-2023-34133 describes an improper neutralization of special elements used in SQL commands, allowing an unauthenticated attacker to extract sensitive information from the SonicWall GMS and Analytics application database. This issue affects GMS versions 9.3.2-SP1 and earlier, and Analytics versions 2.5.0.4-R7 and earlier.

Risk Assessment

An attacker could gain access to confidential data, potentially leading to serious security breaches and loss of trust in the system. Organizations may face legal and financial consequences related to data leaks.

Recommendation

It is recommended to upgrade to the latest versions of SonicWall GMS and Analytics that address this vulnerability. Additionally, implementing further security measures such as monitoring and restricting database access is advisable.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.