CVE-2023-30802

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid Content-Length field.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-540 CWE-668

Affected software

Vendor	Product	Versions
Sangfor	Net-Gen Application Firewall	8.0.17

References

https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4Product
https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sangfor-edition/Exploit, Third Party Advisory
https://vulncheck.com/advisories/sangfor-ngaf-sourceThird Party Advisory
https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4Product
https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sangfor-edition/Exploit, Third Party Advisory
https://vulncheck.com/advisories/sangfor-ngaf-sourceThird Party Advisory

Timeline

Published: Oct 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-308039.8The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthent CVE-2023-308046.5The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and a CVE-2023-308059.8The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote CVE-2023-308069.8The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote CVE-2023-30816.1The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1 CVE-2023-30826.1The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 d CVE-2023-30838.7Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-308377.5Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior CVE-2023-308389.9PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Pr CVE-2023-308398.8PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO use CVE-2023-30848.1Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-308407.8Fluid is an open source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. Starting in vers