Session Fixation in Guardian/CMC before 22.6.2
Priority LOW 23CWE-384Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-384.
Summary
In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.
Why it matters now
EPSS 0.00146 3rd percentileScored 2026-11-07
Fix Fixed Guardian (Nozomi Networks): 22.6.2CMC (Nozomi Networks): 22.6.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Nozomi Networks | Guardian | before 22.6.2 | 22.6.2 | Patch available | CNA |
| Nozomi Networks | CMC | before 22.6.2 | 22.6.2 | Patch available | CNA |
- Guardian VendorNozomi Networks Affected before 22.6.2 Fixed in 22.6.2 Patch available CNA
- CMC VendorNozomi Networks Affected before 22.6.2 Fixed in 22.6.2 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:* | before 22.6.2 | Vulnerable | Nozomi Networks |
| cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:* | before 22.6.2 | Vulnerable | Nozomi Networks |
- cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:* Versions before 22.6.2 Vulnerable ·Nozomi Networks
- cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:* Versions before 22.6.2 Vulnerable ·Nozomi Networks
Remediation
- Fix · CNA Guardian (Nozomi Networks) Fixed in 22.6.2
- Fix · CNA CMC (Nozomi Networks) Fixed in 22.6.2
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Nozomi Networks CMC, Guardian 22.6.2
7 records Highest priority Priority MEDIUM 1 MEDIUM, 6 LOW
Other records, highest priority first
- TI-2023-09405 Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2Priority MEDIUM 41
- TI-2023-08638 Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2Priority LOW 39
- TI-2023-08997 Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2Priority LOW 34
Timeline
- 2026-10-02 Threatist record created from CVE-2023-24477
- 2026-10-03 Alias added: GHSA-45cq-w2jp-hqp4
References
More Nozomi Networks Cmc vulnerabilities
- TI-2022-00470 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 CVSS 4.0HIGH 8.6
- TI-2026-24526 DoS through oversized audit log entries in Guardian/CMC before 26.2.0 CVSS 4.0HIGH 8.7
- TI-2023-15926 DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 CVSS 4.0HIGH 8.2
- TI-2023-13657 SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 CVSS 4.0CRITICAL 9.2
- TI-2023-09405 Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2 CVSS 4.0HIGH 8.7
- TI-2023-02399 Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0 CVSS 4.0HIGH 8.7
Sources
- CVE-2023-24477 · CVE Program
- CVE-2023-24477 · NVD
- FIRST EPSS
- GHSA-45cq-w2jp-hqp4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences