« Volver al listado

CVE-2023-34198

Estado: AnalizadaAlta (7.3)—

In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a Network object created from an inactive DHCP interface in the filtering slot results in the usage of an object of the :any" type, which may have unexpected results for access control.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Stormshield — Stormshield Network Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-34198",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-34198",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-02-29T20:37:35.297426Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-02-29T01:39:48.740",
  "references": [
    {
      "url": "https://advisories.stormshield.eu/2023-019",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://advisories.stormshield.eu/2023-019",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a Network object created from an inactive DHCP interface in the filtering slot results in the usage of an object of the :any\" type, which may have unexpected results for access control."
    },
    {
      "lang": "es",
      "value": "En Stormshield Network Security (SNS) 1.0.0 hasta 3.7.36 antes de 3.7.37, 3.8.0 hasta 3.11.24 antes de 3.11.25, 4.0.0 hasta 4.3.18 antes de 4.3.19, 4.4.0 hasta 4.6.5 Antes de 4.6.6 y 4.7.0 antes de 4.7.1, el uso de un objeto de red creado a partir de una interfaz DHCP inactiva en la ranura de filtrado da como resultado el uso de un objeto del tipo \"cualquiera\", que puede tener resultados inesperados para control de acceso."
    }
  ],
  "lastModified": "2026-06-17T06:03:06.890",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5846B1C5-9E1B-49F5-91E9-0AE2C7863FDE",
              "versionEndExcluding": "3.7.37",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A2DF2A4-8CA3-431A-B8BB-D493062D5018",
              "versionEndExcluding": "3.11.25",
              "versionStartIncluding": "3.8.0"
            },
            {
              "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BA1A0D0-CA90-488A-839E-2B837A7DAF7A",
              "versionEndExcluding": "4.3.19",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35AD89FF-2468-42AE-8AE0-5975F7BA7DB3",
              "versionEndExcluding": "4.6.6",
              "versionStartIncluding": "4.4.0"
            },
            {
              "criteria": "cpe:2.3:a:stormshield:stormshield_network_security:4.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "41064506-1A8B-462B-B0CC-935467EB80CA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}