ZDI-24-420: SonicWALL GMS Virtual Appliance ECMPolicy XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of SonicWALL GMS Virtual Appliance. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2024-29010.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-420?
ZDI-24-420 is classified as a serious vulnerability due to its ability to disclose sensitive information.
How do I fix ZDI-24-420?
To fix ZDI-24-420, update the SonicWALL GMS Virtual Appliance to the latest version as recommended by SonicWALL.
Who is affected by ZDI-24-420?
ZDI-24-420 affects installations of SonicWALL GMS Virtual Appliance that have the vulnerability present.
Can ZDI-24-420 be exploited without authentication?
No, while authentication is required, the vulnerability allows existing authentication mechanisms to be bypassed.
What type of information can be disclosed by ZDI-24-420?
ZDI-24-420 can lead to the disclosure of sensitive information stored on affected SonicWALL GMS Virtual Appliance installations.