Lucene search

PRIOn knowledge basePRION:CVE-2023-2567

HistorySep 19, 2023 - 11:16 a.m.

Sql injection

2023-09-1911:16:00

PRIOn knowledge base

www.prio-n.com

vulnerability

input validation

authenticated attacker

arbitrary sql queries

dbms

web application

uncontrolled information extraction

7 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

A SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain parameters used in the Query functionality, allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application.
Authenticated users can extract arbitrary information from the DBMS in an uncontrolled way.

CPENameOperatorVersion
cmcge23.0.0
cmclt23.1.0
cmcge22.6.0
cmclt22.6.3
guardiange23.0.0
guardianlt23.1.0
guardiange22.6.0
guardianlt22.6.3

Name	Operator	Version
cmc	ge	23.0.0
cmc	lt	23.1.0
cmc	ge	22.6.0
cmc	lt	22.6.3
guardian	ge	23.0.0
guardian	lt	23.1.0
guardian	ge	22.6.0
guardian	lt	22.6.3

References

security.nozominetworks.com/NN-2023:9-01