What’s Vulnerable › Vulnerabilities

CVE-2023-22378: Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-09 · updated 2026-06-17
• Weakness: CWE-89

Description

A blind SQL Injection vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in the sorting parameter, allows an authenticated attacker to execute arbitrary SQL statements on the DBMS used by the web application. Authenticated users may be able to extract arbitrary information from the DBMS in an uncontrolled way, alter its structure and data, and/or affect its availability.

Affected products

• Nozomi Networks CMC: before 22.6.2 — fixed in 22.6.2
• Nozomi Networks Guardian: before 22.6.2 — fixed in 22.6.2

How to fix

Upgrade to a fixed version: Nozomi Networks CMC 22.6.2; Nozomi Networks Guardian 22.6.2. Check the vendor advisory for mitigations.

References

• https://security.nozominetworks.com/NN-2023:2-01
• https://security.nozominetworks.com/NN-2023:2-01

Get alerted when CVE-2023-22378 or the next vulnerability affects your stack