CVE-2023-34134
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
CVE-2023-34134 describes a vulnerability that exposes sensitive information, allowing an authenticated attacker to read the administrator password hash via a web service call in SonicWall GMS and Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Risk Assessment
The exposure of the administrator password may lead to unauthorized access to the system, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to the latest versions of SonicWall GMS and Analytics to mitigate this vulnerability.
Other vulnerabilities in SonicWall GMS i Analytics
See all- CVE-2023-34133High
CVE-2023-34133 describes an improper neutralization of special elements used in SQL commands, allowing an unauthenticated attacker to extract sensitive information from the SonicWall GMS and Analytics application database. This issue affects GMS versions 9.3.2-SP1 and earlier, and Analytics versions 2.5.0.4-R7 and earlier.
- CVE-2023-34132Critical
CVE-2023-34132 describes a vulnerability where the use of password hash instead of password for authentication in SonicWall GMS and Analytics allows for Pass-the-Hash attacks. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34129High
The 'Path Traversal' vulnerability in SonicWall GMS and Analytics allows an authenticated remote attacker to traverse directories and extract arbitrary files using the Zip Slip method, gaining access to the filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34128Critical
The Tomcat application credentials are hardcoded in the SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34135Medium
Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via web service. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34131Medium
A vulnerability in SonicWall GMS and Analytics allows an unauthorized attacker to access restricted web pages. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Original NVD description (English source)
Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator password hash via a web service call. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.