DoS via SAML configuration in Guardian/CMC before 22.6.2
CVE-2023-23903

4.9MEDIUM

Key Information:

Vendor

Nozomi Networks

Status
Guardian
Cmc
Vendor
CVE Published:
9 August 2023

What is CVE-2023-23903?

An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application request will return an error.

The whole application in rendered unusable until a console intervention.

Affected Version(s)

CMC 0 < 22.6.2

Guardian 0 < 22.6.2

References

https://security.nozominetworks.com/NN-2023:7-01

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was found by Stefano Libero of Nozomi Networks Product Security team during a scheduled internal VAPT testing session.
.