{"id":"CVE-2023-24471","state":"PUBLISHED","title":"Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2","description":"An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality.\n\nAn authenticated user with reduced visibility can obtain unauthorized information via the debug functionality, obtaining data that would normally be not accessible in the Query and Assertions functions.","publishedAt":"2023-08-09T08:54:27.616Z","updatedAt":"2024-08-02T10:56:04.274Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"Nozomi"},"assigner":"Nozomi","products":["Nozomi Networks Guardian","Nozomi Networks CMC"],"affected":[{"vendor":"Nozomi Networks","product":"Guardian","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"22.6.2","versionType":"semver"}]},{"vendor":"Nozomi Networks","product":"CMC","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"22.6.2","versionType":"semver"}]}],"references":["https://security.nozominetworks.com/NN-2023:5-01"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/24xxx/CVE-2023-24471.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-24471","state":"PUBLISHED","datePublished":"2023-08-09T08:54:27.616Z","dateUpdated":"2024-08-02T10:56:04.274Z","assignerShortName":"Nozomi","assignerOrgId":"bec8025f-a851-46e5-b3a3-058e6b0aa23c","dateReserved":"2023-01-24T10:39:24.296Z"},"containers":{"cna":{"title":"Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2","descriptions":[{"lang":"en","value":"An access control vulnerability was found, due to the restrictions that are applied on actual assertions not being enforced in their debug functionality.\n\nAn authenticated user with reduced visibility can obtain unauthorized information via the debug functionality, obtaining data that would normally be not accessible in the Query and Assertions functions."}],"affected":[{"vendor":"Nozomi Networks","product":"Guardian","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"22.6.2","versionType":"semver"}]},{"vendor":"Nozomi Networks","product":"CMC","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"22.6.2","versionType":"semver"}]}],"references":[{"url":"https://security.nozominetworks.com/NN-2023:5-01"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.1,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Nozomi","orgId":"bec8025f-a851-46e5-b3a3-058e6b0aa23c","dateUpdated":"2024-05-28T12:37:58.284Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"This issue was found by Stefano Libero of Nozomi Networks Product Security team during a scheduled internal VAPT testing session."}],"datePublic":"2023-08-09T07:00:00.000Z","impacts":[{"capecId":"CAPEC-122","descriptions":[{"lang":"en","value":"CAPEC-122 Privilege Abuse"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Upgrade to v22.6.2 or later.</p>"}],"value":"Upgrade to v22.6.2 or later."}],"source":{"discovery":"INTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Use internal firewall features to limit access to the web management interface.</p>"}],"value":"Use internal firewall features to limit access to the web management interface."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"nozominetworks","product":"guardian","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"22.6.2","versionType":"custom"}],"cpes":["cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*"]},{"vendor":"nozominetworks","product":"cmc","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"22.6.2","versionType":"custom"}],"cpes":["cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-05-28T15:25:12.862811Z","id":"CVE-2023-24471","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-05T18:59:19.087Z"}},{"title":"CVE Program Container","references":[{"url":"https://security.nozominetworks.com/NN-2023:5-01","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T10:56:04.274Z"}}]}}}