CVE-2023-1101

HighCVSS 8.8/10Last modified Nov 9, 2026

Description

SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
SonicWall	SonicOS	SonicOS 6.5.4.11-97n and earlier; SonicOS NSv 6.5.4.4-44v-21-1551 and earlier; SonicOS NSsp 7.0.1-5083 and earlier; SonicOS 7.0.1-5095 and earlier

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0005Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0005Vendor Advisory

Timeline

Published: Mar 2, 2023
Last modified: Nov 9, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-11045.4Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-11058.1External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-11066.1Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-11075.4Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2023-11087.5A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslCo CVE-2023-11098.8In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files CVE-2023-11105.4The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting the CVE-2023-11114.8A vulnerability was found in FastCMS up to 0.1.5 and classified as problematic. Affected by this issue is some unknown functionality of the CVE-2023-11129.8A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Aff CVE-2023-11134.8A vulnerability was found in SourceCodester Simple Payroll System 1.0. It has been declared as problematic. Affected by this vulnerability i CVE-2023-11149.8Missing Authorization vulnerability in Eskom e-Belediye allows Information Elicitation. This issue affects e-Belediye: from 1.0.0.95 before CVE-2023-11155.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.