5.5

CVE-2018-9867

In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Administrators user group attempt to download imported certificates. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).

Data is provided by the National Vulnerability Database (NVD)
Sonicwall ≫ Sonicos Version >= 5.0.0.0 <= 5.9.1.10
Sonicwall ≫ Sonicos Version6.0.5.3-86o
Sonicwall ≫ Sonicos Version6.2.7.3
Sonicwall ≫ Sonicos Version6.2.7.8
Sonicwall ≫ Sonicos Version6.4.0.0
Sonicwall ≫ Sonicos Version6.5.1.3
Sonicwall ≫ Sonicos Version6.5.1.8
Sonicwall ≫ Sonicos Version6.5.2.2
Sonicwall ≫ Sonicos Version6.5.3.1
Sonicwall ≫ Sonicosv Version6.5.0.2-8v_rc363 SwPlatformvmware
Sonicwall ≫ Sonicosv Version6.5.0.2.8v_rc366 SwPlatformhyper_v
Sonicwall ≫ Sonicosv Version6.5.0.2.8v_rc367 SwPlatformazure
Sonicwall ≫ Sonicosv Version6.5.0.2.8v_rc368 SwPlatformaws
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.02% 0.04
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.