DoS via SAML configuration in Guardian/CMC before 22.6.2 (Nozomi Networks Guardian)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.60 % · percentile 49 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Nozomi
- NVD status
- Modified
Description
An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application request will return an error. The whole application in rendered unusable until a console intervention.
Weaknesses (CWE)
- CWE-1286 — Improper Validation of Syntactic Correctness of Input
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H | Nozomi |
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | Nozomi |
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · prodsec@nozominetworks.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H | NVD · prodsec@nozominetworks.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-27986
- GCVE · GCVE-0-2023-23903
CERT-FR advisories
- CERTFR-2023-AVI-0819 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:*< 22.6.2cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*< 22.6.2
Affected products
| Product | Versions |
|---|---|
| Nozomi Networks · Guardian | affected 0 < 22.6.2 |
| Nozomi Networks · CMC | affected 0 < 22.6.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |