CVE-2023-34136
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Risk Assessment
An attacker could exploit this vulnerability to upload malicious files, potentially leading to further attacks on the organization's systems. This poses a serious threat to the integrity and security of data.
Recommendation
It is recommended to update to the latest versions of GMS and Analytics to mitigate this vulnerability. Additionally, monitoring systems for unauthorized activities is advised.
Other vulnerabilities in SonicWall GMS, SonicWall Analytics
See all- CVE-2023-34137Critical
The SonicWall GMS and Analytics CAS Web Services application uses static values for authentication without proper checks, leading to an authentication bypass vulnerability. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34130Critical
SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34127High
CVE-2023-34127 describes an improper neutralization of special elements used in OS commands, allowing an authenticated attacker to execute arbitrary code with root privileges in SonicWall GMS and SonicWall Analytics. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34124Critical
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34126High
Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
- CVE-2023-34123High
CVE-2023-34123 involves the use of a hard-coded cryptographic key in SonicWall GMS and SonicWall Analytics. This issue affects GMS versions: 9.3.2-SP1 and earlier; Analytics: 2.5.0.4-R7 and earlier.
Original NVD description (English source)
Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.