What’s Vulnerable › Vulnerabilities

CVE-2023-34129

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 41.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-13 · updated 2026-06-17
• Weakness: CWE-22

Description

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authenticated remote attacker to traverse the directory and extract arbitrary files using Zip Slip method to any location on the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

Affected products

• SonicWall Analytics: through 2.5.0.4-r7
• SonicWall Global Management System (GMS): before 9.3.2; 9.3.2, 9.3.2-sp1 — fixed in 9.3.2

How to fix

Upgrade to a fixed version: SonicWall Global Management System (GMS) 9.3.2. Check the vendor advisory for mitigations.

References

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
• https://www.sonicwall.com/support/notices/230710150218060
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0010
• https://www.sonicwall.com/support/notices/230710150218060

Get alerted when CVE-2023-34129 or the next vulnerability affects your stack