Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2
CVE-2023-23574
8.8HIGH
What is CVE-2023-23574?
A blind SQL injection vulnerability exists in the Nozomi Networks Guardian and CMC due to insufficient input validation within the alerts_count component. This flaw may enable authenticated attackers to execute arbitrary SQL queries on the database management system (DBMS) employed by the web application. Consequently, attackers could extract sensitive information, modify database structures and data, or disrupt the availability of the application.
Affected Version(s)
CMC 0 < 22.6.2
Guardian 0 < 22.6.2
References
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This issue was found by Stefano Libero of Nozomi Networks Product Security team during a scheduled internal VAPT testing session.