5.5

CVE-2018-9867

In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Administrators user group attempt to download imported certificates. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sonicwall ≫ Sonicos Version >= 5.0.0.0 <= 5.9.1.10
Sonicwall ≫ Sonicos Version 6.0.5.3-86o
Sonicwall ≫ Sonicos Version 6.2.7.3
Sonicwall ≫ Sonicos Version 6.2.7.8
Sonicwall ≫ Sonicos Version 6.4.0.0
Sonicwall ≫ Sonicos Version 6.5.1.3
Sonicwall ≫ Sonicos Version 6.5.1.8
Sonicwall ≫ Sonicos Version 6.5.2.2
Sonicwall ≫ Sonicos Version 6.5.3.1
Sonicwall ≫ Sonicosv Version 6.5.0.2-8v_rc363 SwPlatform vmware
Sonicwall ≫ Sonicosv Version 6.5.0.2.8v_rc366 SwPlatform hyper_v
Sonicwall ≫ Sonicosv Version 6.5.0.2.8v_rc367 SwPlatform azure
Sonicwall ≫ Sonicosv Version 6.5.0.2.8v_rc368 SwPlatform aws
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.107
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0017
Vendor Advisory
https://www.tenable.com/security/research/tra-2019-08
Third Party Advisory