topic Re: CVE Description clarification in General Topics

CVE Description clarification

Charlie80 — Wed, 24 Jan 2024 08:18:29 GMT

I'm looking at CVE-2023-6795 and in the description I see "enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall"

This means that all admin included the readonly admin like the SuperUser (ReadOnly) can do the execute arbitrary code?

Re: CVE Description clarification

BPry — Wed, 24 Jan 2024 23:07:47 GMT

@Charlie80,

https://cwe.mitre.org/data/definitions/78 helps provide a little bit of insight into the type of exploit that leads to the vulnerability. Anyone authenticated to the GUI has the potential to exploit this vulnerability, which would include any read-only permissioned users.