← Retour aux CVEs

CVE-2018-9866

CRITICAL

9.8

Description

A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual appliance's, allow remote user to execute arbitrary code. This vulnerability affected GMS version 8.1 and earlier.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie8/3/2018

Derniere modification5/5/2025

Sourcenvd

Observations honeypot0

Produits affectes

sonicwall:global_management_system

Faiblesses (CWE)

CWE-77CWE-20

References

https://github.com/rapid7/metasploit-framework/pull/10305(PSIRT@sonicwall.com)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0007(PSIRT@sonicwall.com)

https://twitter.com/ddouhine/status/1019251292202586112(PSIRT@sonicwall.com)

https://github.com/rapid7/metasploit-framework/pull/10305(af854a3a-2127-422b-91ae-364da2661108)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0007(af854a3a-2127-422b-91ae-364da2661108)

https://twitter.com/ddouhine/status/1019251292202586112(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.