Path Traversal in SonicWall GMS/Analytics 9.3.2-SP1 and 2.5.0.4-R7 WebSvc
CVE-2023-34135 Published on July 13, 2023
Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via web service. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Weakness Type
Absolute Path Traversal
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory. This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Products Associated with CVE-2023-34135
stack.watch emails you whenever new vulnerabilities are published in SonicWall Global Management System or SonicWall Analytics. Just hit a watch button to start following.
Affected Versions
SonicWall GMS:- Version 9.3.2-SP1 and earlier versions is affected.
- Version 2.5.0.4-R7 and earlier versions is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.