CVE-2023-34133
Published: 13 July 2023
Summary
CVE-2023-34133 is a high-severity SQL Injection (CWE-89) vulnerability in Sonicwall Global Management System. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-34133 is an SQL injection vulnerability resulting from improper neutralization of special elements in SQL commands, tracked under CWE-89. It affects SonicWall GMS versions 9.3.2-SP1 and earlier as well as Analytics versions 2.5.0.4-R7 and earlier, allowing direct interaction with the application database.
An unauthenticated attacker can exploit the flaw remotely over the network with no credentials or user interaction required, achieving extraction of sensitive information from the database. The vulnerability carries a CVSS 3.1 score of 7.5 reflecting high confidentiality impact with low attack complexity.
SonicWall PSIRT notice SNWLID-2023-0010 and the associated support advisory at sonicwall.com detail the affected releases and direct administrators to remediation steps including patches for supported versions.
The associated EPSS score reached a peak of 0.7308.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-38235
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7…
more
and earlier versions.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.