CVEvulnerability

CVE-2018-9867

5.5 MEDIUM Published 2019-02-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-02-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-285, CWE-732

Description

In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Administrators user group attempt to download imported certificates. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).

Affected configurations

• sonicwall sonicos (>= 5.0.0.0 <= 5.9.1.10) • sonicwall sonicos 6.0.5.3-86o • sonicwall sonicos 6.2.7.3 • sonicwall sonicos 6.2.7.8 • sonicwall sonicos 6.4.0.0 • sonicwall sonicos 6.5.1.3 • sonicwall sonicos 6.5.1.8 • sonicwall sonicos 6.5.2.2 • sonicwall sonicos 6.5.3.1 • sonicwall sonicosv 6.5.0.2-8v rc363 • sonicwall sonicosv 6.5.0.2.8v rc366 • sonicwall sonicosv 6.5.0.2.8v rc367 • sonicwall sonicosv 6.5.0.2.8v rc368

Related

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References