CVE-2023-34134 Information disclosure in Analytics

What is CVE-2023-34134?

CVE-2023-34134 is a medium-severity vulnerability in SonicWall Analytics, published on 13 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator password hash via a web service call. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

Weakness: CWE-200

Which versions are affected by CVE-2023-34134?

It affects 2 products.

Products include Sonicwall Analytics, Sonicwall Global Management System.

How do I fix CVE-2023-34134?

No fix has been published for CVE-2023-34134 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-34134 being exploited?

There is no known exploitation of CVE-2023-34134 in the wild and no public exploit code.

Other vulnerabilities in SonicWall Analytics

• CVE-2023-34124 Auth bypass in Analytics Critical 9.8
• CVE-2023-34128 Hardcoded credentials in Analytics Critical 9.8
• CVE-2023-34130 Weak cryptography in Analytics Critical 9.8
• CVE-2023-34132 Auth bypass in Analytics Critical 9.8
• CVE-2023-34136 File upload in Analytics Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2qh4-v69r-w9m5.