Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0

Summary Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or report manager roles to execute unattended commands on the appliance using web server user privileges. Impact Users with admin or report...

Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0

Summary Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manager roles to execute unattended commands on the appliance using web server user privileges. Impact Users with admin or import manage...

Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4

Summary An authenticated command path traversal vulnerability in the management interface allows an authenticated administrator to read-protected system files. Impact Authenticated web GUI administrator can force the system to copy system files to the wrong location allowing him to read the...

Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4

Summary An OS command injection vulnerability in the management interface allows an authenticated administrator to execute arbitrary OS commands gaining access to the system. Impact Authenticated web GUI administrator can execute a command on the local system and then escalate privilege to the ro...

Cross-site request forgery attack on change password form

Summary Change password doesn't validate CSRF token properly. Impact An attacker can force the victim to change password without knowing. To successfully complete this attack the victim needs to be logged to the Guardian/CMC and visit a special prepared page containing the forged change password...

Angular template injection on custom report name field

Summary Report name field is affected by angular template injection which can lead to XSS attacks. Impact Custom report name field can lead to XSS attacks by malicious users. The attacker must have a valid Guardian/CMC login with the ‘Report editor’ capability to leverage this. Mitigation None...

NGINX allows HTTP request smuggling

Summary Under some special configuration NGINX permits HTTP request smuggling which can lead an attacker to access unauthorized web pages. Impact None. Our products are not affected by this issue because the configuration used is not vulnerable. Mitigation Not required Solution Not required...

CSV Injection on node label

Summary CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. An authenticated malicious user can insert a crafted formula in the node label that can be later executed on another system after another user has downloaded and opened the node li...

Stored XSS in field name data model

Summary An attacker with admin access to the appliance can inject malicious code that will later be executed by another legitimate users. This allows an attacker to perform unauthorized actions on behalf of legitimate users. JavaScript injection was possible using the field name when adding new...