Lucene search

SonicwallCVELIST:CVE-2024-22395

HistoryFeb 23, 2024 - 11:37 p.m.

CVE-2024-22395

2024-02-2323:37:06

CWE-287

sonicwall

www.cve.org

cve-2024-22395

access control

sma100 ssl-vpn

remote attacker

mfa

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

6.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user’s MFA mobile application.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "SMA100",
    "vendor": "SonicWall",
    "versions": [
      {
        "status": "affected",
        "version": "10.2.1.10-62sv and earlier versions"
      }
    ]
  }
]

References

psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0001