Vulnerability Details : CVE-2023-30802
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid Content-Length field.
Products affected by CVE-2023-30802
- cpe:2.3:a:sangfor:next-gen_application_firewall:8.0.17:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-30802
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 37 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-30802
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
VulnCheck | |
|
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2023-30802
-
Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.Assigned by: disclosure@vulncheck.com (Secondary)
-
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-30802
-
https://vulncheck.com/advisories/sangfor-ngaf-source
Sangfor Next-Gen Application Firewall Source Code Disclosure | VulnCheck AdvisoriesThird Party Advisory
-
https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sangfor-edition/
Yet More Unauth Remote Command Execution Vulns in Firewalls - Sangfor EditionExploit;Third Party Advisory
-
https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4
AWS Marketplace: Sangfor Next-Gen Application FirewallProduct
Jump to