Vulnerabilities

TI-2023-14616 CVE-2023-30806 · GHSA-xmqp-wmrm-vqv8

Sangfor Next-Gen Application Firewall PHPSESSID Command Injection

CRITICAL 85

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.64974 Published 2023-10-10 No fix listed CWE-78

TI-2023-14615 CVE-2023-30805 · GHSA-398q-w43p-26hx

CRITICAL 85

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.64974 Published 2023-10-10 No fix listed CWE-78

TI-2023-14614 CVE-2023-30804 · GHSA-59w3-fc6m-5c93

MEDIUM 64

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.38947 Published 2023-10-10 No fix listed CWE-22

TI-2023-14613 CVE-2023-30803 · GHSA-rch9-592x-rrw8

HIGH 82

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20887 Published 2023-10-10 No fix listed CWE-290

TI-2023-14612 CVE-2023-30802 · GHSA-9j86-wqqw-j67h

MEDIUM 63

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00807 Published 2023-10-10 No fix listed CWE-540