Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2
CVE-2023-24471

6.5MEDIUM

Key Information:

Vendor: Nozomi Networks
Status: Guardian; Cmc
Vendor: CVE Published:; 9 August 2023

🔔 Create Nozomi Networks Vulnerability Alert

What is CVE-2023-24471?

An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality.

An authenticated user with reduced visibility can obtain unauthorized information via the debug functionality, obtaining data that would normally be not accessible in the Query and Assertions functions.

Affected Version(s)

CMC 0 < 22.6.2

Guardian 0 < 22.6.2

References

https://security.nozominetworks.com/NN-2023:5-01

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 9, 2023
Vulnerability Reserved
Jan 24, 2023

Credit

This issue was found by Stefano Libero of Nozomi Networks Product Security team during a scheduled internal VAPT testing session.