File Upload Vulnerability in SonicWall GMS and Analytics Products
CVE-2023-34126

8.8HIGH

Key Information:

Vendor

Sonicwall
Status
Gms
Analytics
Vendor
CVE Published:
13 July 2023

What is CVE-2023-34126?

A vulnerability in SonicWall's GMS and Analytics products enables an authenticated attacker to upload arbitrary files to the underlying filesystem with root privileges. This creates significant security risks, as the attacker could leverage these permissions to conduct further malicious activities. The affected versions of GMS include 9.3.2-SP1 and earlier, while the impacted Analytics versions are 2.5.0.4-R7 and earlier. Organizations using these platforms should apply the necessary updates and mitigations to safeguard their systems.

Affected Version(s)

Analytics 2.5.0.4-R7 and earlier versions

GMS 9.3.2-SP1 and earlier versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-202...
vendor-advisory
https://www.sonicwall.com/support/notices/230710150218060
related

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-34126 : File Upload Vulnerability in SonicWall GMS and Analytics Products