{"id":"CVE-2023-6916","state":"PUBLISHED","title":"Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1","description":"Audit records for OpenAPI requests may include sensitive information.\n\n\n\nThis could lead to unauthorized accesses and privilege escalation.","publishedAt":"2024-04-10T15:50:57.919Z","updatedAt":"2024-09-20T11:47:45.639Z","severity":{"score":7.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"Nozomi"},"assigner":"Nozomi","products":["Nozomi Networks Guardian","Nozomi Networks CMC"],"affected":[{"vendor":"Nozomi Networks","product":"Guardian","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.4.1","versionType":"semver"}]},{"vendor":"Nozomi Networks","product":"CMC","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.4.1","versionType":"semver"}]}],"references":["https://security.nozominetworks.com/NN-2023:17-01"],"weaknesses":["CWE-201"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/6xxx/CVE-2023-6916.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-6916","state":"PUBLISHED","datePublished":"2024-04-10T15:50:57.919Z","dateUpdated":"2024-09-20T11:47:45.639Z","assignerShortName":"Nozomi","assignerOrgId":"bec8025f-a851-46e5-b3a3-058e6b0aa23c","dateReserved":"2023-12-18T10:31:09.989Z"},"containers":{"cna":{"title":"Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1","descriptions":[{"lang":"en","value":"Audit records for OpenAPI requests may include sensitive information.\n\n\n\nThis could lead to unauthorized accesses and privilege escalation."}],"affected":[{"vendor":"Nozomi Networks","product":"Guardian","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.4.1","versionType":"semver"}]},{"vendor":"Nozomi Networks","product":"CMC","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.4.1","versionType":"semver"}]}],"references":[{"url":"https://security.nozominetworks.com/NN-2023:17-01"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7.5,"baseSeverity":"HIGH","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-201","description":"CWE-201 Insertion of Sensitive Information Into Sent Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Nozomi","orgId":"bec8025f-a851-46e5-b3a3-058e6b0aa23c","dateUpdated":"2024-09-20T11:47:45.639Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"This issue was reported by Maciej Kosz."}],"datePublic":"2024-04-10T15:41:00.000Z","impacts":[{"capecId":"CAPEC-114","descriptions":[{"lang":"en","value":"CAPEC-114 Authentication Abuse"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div><div>Upgrade to v23.4.1 or later.</div></div>"}],"value":"Upgrade to v23.4.1 or later."}],"source":{"discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div><div>Nozomi Networks recommends creating specific users for OpenAPI usage, with only the necessary permissions to access the required data sources.<br>Additionally, it is advised to limit API keys to allowed IP addresses whenever possible.<br>Finally, it is also suggested to regenerate existing API keys periodically and to review sign-ins via API keys in the audit records.</div></div>"}],"value":"Nozomi Networks recommends creating specific users for OpenAPI usage, with only the necessary permissions to access the required data sources.\nAdditionally, it is advised to limit API keys to allowed IP addresses whenever possible.\nFinally, it is also suggested to regenerate existing API keys periodically and to review sign-ins via API keys in the audit records."}],"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://security.nozominetworks.com/NN-2023:17-01","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:42:08.668Z"}},{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"nozominetworks","product":"guardian","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"23.4.1","versionType":"semver"}],"cpes":["cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:*"]},{"vendor":"nozominetworks","product":"central_management_control","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"23.4.1","versionType":"semver"}],"cpes":["cpe:2.3:a:nozominetworks:central_management_control:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-04-10T19:50:52.538053Z","id":"CVE-2023-6916","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-12T17:26:46.970Z"}}]}}}