A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_count component, allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application.
Authenticated users can extract arbitrary information from the DBMS in an uncontrolled way.
References
| Link | Resource |
|---|---|
| https://security.nozominetworks.com/NN-2023:3-01 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
28 May 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the alerts_count component, allows an authenticated attacker to execute arbitrary SQL queries on the DBMS used by the web application. Authenticated users can extract arbitrary information from the DBMS in an uncontrolled way. |
15 Aug 2023, 16:07
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CPE | cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:* cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:* |
|
| First Time |
Nozominetworks cmc
Nozominetworks guardian Nozominetworks |
|
| References | (MISC) https://security.nozominetworks.com/NN-2023:3-01 - Vendor Advisory |
09 Aug 2023, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-09 09:15
Updated : 2024-05-28 13:15
NVD link : CVE-2023-23574
Mitre link : CVE-2023-23574
CVE.ORG link : CVE-2023-23574
JSON object : View
Products Affected
nozominetworks
- guardian
- cmc
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')