Lucene search

NozomiVULNRICHMENT:CVE-2023-24471

HistoryAug 09, 2023 - 8:54 a.m.

CVE-2023-24471 Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2

2023-08-0908:54:27

CWE-863

Nozomi

github.com

information disclosure

debug function

assertions

access control vulnerability

authenticated user

unauthorized information

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS4

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

28.3%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality.

An authenticated user with reduced visibility can obtain unauthorized information via the debug functionality, obtaining data that would normally be not accessible in the Query and Assertions functions.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*"
    ],
    "vendor": "nozominetworks",
    "product": "guardian",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "22.6.2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:*"
    ],
    "vendor": "nozominetworks",
    "product": "cmc",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "22.6.2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

security.nozominetworks.com/NN-2023:5-01

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS4

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

28.3%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2023-24471