CVE-2023-30804

MediumCVSS 6.5/10Last modified Oct 1, 2026

Description

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the svpn_html/loadfile.php endpoint. This issue is exploitable by a remote and unauthenticated attacker when paired with CVE-2023-30803.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Sangfor	Next-Gen Application Firewall (NGAF)	8.0.17

References

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/sangfor/sangfor-ngaf-lfi.yaml
https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sangfor-edition/Exploit, Third Party Advisory
https://vulncheck.com/advisories/sangfor-ngaf-auth-file-disclosureThird Party Advisory
https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4Product
https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sangfor-edition/Exploit, Third Party Advisory
https://vulncheck.com/advisories/sangfor-ngaf-auth-file-disclosureThird Party Advisory

Timeline

Published: Oct 10, 2023
Last modified: Oct 1, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-308059.8The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote CVE-2023-308069.8The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote CVE-2023-30816.1The WP Mail Logging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 1 CVE-2023-30826.1The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.5.7 d CVE-2023-30838.7Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-308377.5Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior CVE-2023-308389.9PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Pr CVE-2023-308398.8PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO use CVE-2023-30848.1Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.CVE-2023-308407.8Fluid is an open source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. Starting in vers CVE-2023-308415.5Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector d CVE-2023-308436.5Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that con