Medium severity · published Jul 13, 2023
CVE-2023-34131
Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker to access restricted web pages
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker to access restricted web pages. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Analytics · Sonicwall
through 2.5.0.4-r7 · source: NVD
GM
Global Management System · Sonicwall
before 9.3.2; 9.3.2; 9.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-34131
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-34131
Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
Vendor Advisory
https://www.sonicwall.com/support/notices/230710150218060
More from Analytics
9.8
CVE-2023-34137
SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerability
9.8
CVE-2023-34136
Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker
9.8
CVE-2023-34132
Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks
9.8
CVE-2023-34130
SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data
9.8
CVE-2023-34128
Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file