CVE-2013-1359

EPSS 89.4%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 89.4%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

17 Jan 2012Metasploit module available

18 Jan 2013Public PoC

11 Feb 2020Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, 5.1, and 6.0 via the skipSessionCheck parameter to the UMA interface (/appliance/), which could let a remote malicious user obtain access to the root account.

Affected products

n/a · n/a

public PoCs found — 5

cve_referencepacketstormsecurity.com/files/author/7547/unverified cve_referencewww.exploit-db.com/exploits/24204unverified cve_referencewww.exploit-db.com/exploits/24322unverified exploitdbwww.exploit-db.com/exploits/24322unverified exploitdbwww.exploit-db.com/exploits/24204unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/81367 https://fortiguard.com/encyclopedia/ips/35264/multiple-sonicwall-products-authentication-bypass-vulns https://packetstormsecurity.com/files/author/7547/https://seclists.org/fulldisclosure/2013/Jan/125 http://www.exploit-db.com/exploits/24204 http://www.exploit-db.com/exploits/24322 http://www.securityfocus.com/bid/57445 http://www.securitytracker.com/id/1028007