A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application.
Authenticated users can extract arbitrary information from the DBMS in an uncontrolled way.
References
| Link | Resource |
|---|---|
| https://security.nozominetworks.com/NN-2023:2-01 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
28 May 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application. Authenticated users can extract arbitrary information from the DBMS in an uncontrolled way. |
15 Aug 2023, 16:06
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://security.nozominetworks.com/NN-2023:2-01 - Vendor Advisory | |
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| First Time |
Nozominetworks cmc
Nozominetworks guardian Nozominetworks |
|
| CPE | cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:* cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:* |
09 Aug 2023, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-09 09:15
Updated : 2024-05-28 13:15
NVD link : CVE-2023-22378
Mitre link : CVE-2023-22378
CVE.ORG link : CVE-2023-22378
JSON object : View
Products Affected
nozominetworks
- guardian
- cmc
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')