Lucene search

[email protected]CVE-2018-9867

HistoryFeb 19, 2019 - 9:29 p.m.

CVE-2018-9867

2019-02-1921:29:00

CWE-732

CWE-285

[email protected]

web.nvd.nist.gov

sonicwall

sonicos

certificates

vulnerability

cve-2018-9867

security issue

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.6%

JSON

In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Administrators user group attempt to download imported certificates. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).

Affected configurations

NVD

Node

sonicwallsonicosRange5.0.0.0–5.9.1.10

sonicwallsonicosMatch6.0.5.3-86o

sonicwallsonicosMatch6.2.7.3

sonicwallsonicosMatch6.2.7.8

sonicwallsonicosMatch6.4.0.0

sonicwallsonicosMatch6.5.1.3

sonicwallsonicosMatch6.5.1.8

sonicwallsonicosMatch6.5.2.2

sonicwallsonicosMatch6.5.3.1

sonicwallsonicosvMatch6.5.0.2-8v_rc363vmware

sonicwallsonicosvMatch6.5.0.2.8v_rc366hyper_v

sonicwallsonicosvMatch6.5.0.2.8v_rc367azure

sonicwallsonicosvMatch6.5.0.2.8v_rc368aws

CPENameOperatorVersion
sonicwall:sonicossonicwall sonicosle5.9.1.10
sonicwall:sonicossonicwall sonicoseq6.0.5.3-86o
sonicwall:sonicossonicwall sonicoseq6.2.7.3
sonicwall:sonicossonicwall sonicoseq6.2.7.8
sonicwall:sonicossonicwall sonicoseq6.4.0.0
sonicwall:sonicossonicwall sonicoseq6.5.1.3
sonicwall:sonicossonicwall sonicoseq6.5.1.8
sonicwall:sonicossonicwall sonicoseq6.5.2.2
sonicwall:sonicossonicwall sonicoseq6.5.3.1
sonicwall:sonicosvsonicwall sonicosveq6.5.0.2-8v_rc363

CPE	Name	Operator	Version
sonicwall:sonicos	sonicwall sonicos	le	5.9.1.10
sonicwall:sonicos	sonicwall sonicos	eq	6.0.5.3-86o
sonicwall:sonicos	sonicwall sonicos	eq	6.2.7.3
sonicwall:sonicos	sonicwall sonicos	eq	6.2.7.8
sonicwall:sonicos	sonicwall sonicos	eq	6.4.0.0
sonicwall:sonicos	sonicwall sonicos	eq	6.5.1.3
sonicwall:sonicos	sonicwall sonicos	eq	6.5.1.8
sonicwall:sonicos	sonicwall sonicos	eq	6.5.2.2
sonicwall:sonicos	sonicwall sonicos	eq	6.5.3.1
sonicwall:sonicosv	sonicwall sonicosv	eq	6.5.0.2-8v_rc363

Rows per page:

1-10 of 131

CNA Affected

[
  {
    "product": "SonicOS",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "5.9.1.10 and earlier"
      },
      {
        "status": "affected",
        "version": "6.2.7.3"
      },
      {
        "status": "affected",
        "version": "6.5.1.3"
      },
      {
        "status": "affected",
        "version": "6.5.2.2"
      },
      {
        "status": "affected",
        "version": "6.5.3.1"
      },
      {
        "status": "affected",
        "version": "6.2.7.8"
      },
      {
        "status": "affected",
        "version": "6.4.0.0"
      },
      {
        "status": "affected",
        "version": "6.5.1.8"
      },
      {
        "status": "affected",
        "version": "6.0.5.3-86o"
      }
    ]
  },
  {
    "product": "SonicOSv",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "6.5.0.2-8v_RC363 (VMWARE)"
      },
      {
        "status": "affected",
        "version": "6.5.0.2.8v_RC367 (AZURE)"
      },
      {
        "status": "affected",
        "version": "6.5.0.2.8v_RC368 (AWS)"
      },
      {
        "status": "affected",
        "version": "6.5.0.2.8v_RC366 (HYPER_V)"
      }
    ]
  }
]

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0017

www.tenable.com/security/research/tra-2019-08

Social References

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.6%

JSON

Related for CVE-2018-9867

cvelist1 nvd1 prion1