Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authenticated remote attacker to traverse the directory and extract arbitrary files using Zip Slip method to any location on the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
References
| Link | Resource |
|---|---|
| https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010 | Vendor Advisory |
| https://www.sonicwall.com/support/notices/230710150218060 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
20 Jul 2023, 19:14
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sonicwall global Management System
Sonicwall analytics Sonicwall |
|
| CWE | CWE-22 | |
| CPE | cpe:2.3:a:sonicwall:global_management_system:9.3.2:sp1:*:*:*:*:*:* cpe:2.3:a:sonicwall:analytics:*:*:*:*:*:*:*:* cpe:2.3:a:sonicwall:global_management_system:9.3.2:-:*:*:*:*:*:* cpe:2.3:a:sonicwall:global_management_system:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| References | (MISC) https://www.sonicwall.com/support/notices/230710150218060 - Vendor Advisory | |
| References | (MISC) https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010 - Vendor Advisory |
13 Jul 2023, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-13 02:15
Updated : 2023-12-10 15:14
NVD link : CVE-2023-34129
Mitre link : CVE-2023-34129
CVE.ORG link : CVE-2023-34129
JSON object : View
Products Affected
sonicwall
- analytics
- global_management_system
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')