Arbitrary JavaScript Code Execution Vulnerability in SonicOS SSLVPN Portal
CVE-2024-22397

8.3HIGH

Key Information:

Vendor
Sonicwall
Status
Sonicos
Vendor
CVE Published:
14 March 2024

Summary

A Cross-site Scripting (XSS) vulnerability exists in the SonicWall SonicOS SSLVPN portal, allowing a remote authenticated attacker with admin privileges to inject and execute malicious JavaScript code. This flaw poses a risk as it could enable the attacker to manipulate web pages served to users, potentially leading to unauthorized access or data loss.

Affected Version(s)

SonicOS Gen7 7.0.1-5145 and earlier versions

SonicOS Gen7 7.1.1-7047 and earlier versions

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-202...
vendor-advisory

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.