CVEvulnerability

CVE-2023-28130

7.2 HIGH Published 2023-07-26 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2023-07-26
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-20, CWE-77

Description

Local user may lead to privilege escalation using Gaia Portal hostnames page.

Affected configurations

• checkpoint gaia portal r80.40 • checkpoint gaia portal r81 • checkpoint gaia portal r81.10 • checkpoint gaia portal r81.20

Related

Weakness · CWE (2)

CWE-20 Improper Input Validation weakness
CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References

http://packetstormsecurity.com/files/173918/Checkpoint-Gaia-Portal-R81.10-Remote-Command-Execution.html Third Party Advisory
http://seclists.org/fulldisclosure/2023/Aug/4 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/43 Not Applicable
https://pentests.nl/pentest-blog/cve-2023-28130-command-injection-in-check-point-gaia-portal/ Exploit, Third Party Advisory
https://support.checkpoint.com/results/sk/sk181311 Vendor Advisory
http://packetstormsecurity.com/files/173918/Checkpoint-Gaia-Portal-R81.10-Remote-Command-Execution.html Third Party Advisory
http://seclists.org/fulldisclosure/2023/Aug/4 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Jul/43 Not Applicable
https://pentests.nl/pentest-blog/cve-2023-28130-command-injection-in-check-point-gaia-portal/ Exploit, Third Party Advisory
https://support.checkpoint.com/results/sk/sk181311 Vendor Advisory