ZDI-CAN-22675: ZDI-24-420: SonicWALL GMS Virtual Appliance ECMPolicy XML External Entity Processing Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of SonicWALL GMS Virtual Appliance. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The ZDI has assigned a CVSS rating of 7.1. The following CVEs are assigned: CVE-2024-29010.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-22675?
The severity of ZDI-CAN-22675 is classified as high due to the potential for remote attackers to disclose sensitive information.
How do I fix ZDI-CAN-22675?
To fix ZDI-CAN-22675, ensure that you update the SonicWALL GMS Virtual Appliance to the latest security patch provided by the vendor.
What impact does ZDI-CAN-22675 have on SonicWALL GMS Virtual Appliance?
ZDI-CAN-22675 allows attackers to bypass authentication and access sensitive information, potentially compromising system security.
Is authentication required to exploit ZDI-CAN-22675?
Yes, while authentication is required to exploit ZDI-CAN-22675, the existing authentication mechanism can be bypassed.
What should I do if I cannot upgrade my SonicWALL GMS Virtual Appliance to mitigate ZDI-CAN-22675?
If unable to upgrade, consider implementing additional network segmentation and monitoring to limit access to affected systems.