{
    "data_version": "4.0",
    "data_type": "CVE",
    "data_format": "MITRE",
    "CVE_data_meta": {
        "ID": "CVE-2023-6916",
        "ASSIGNER": "prodsec@nozominetworks.com",
        "STATE": "PUBLIC"
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "Audit records for OpenAPI requests may include sensitive information.\n\n\n\nThis could lead to unauthorized accesses and privilege escalation."
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-522 Insufficiently Protected Credentials",
                        "cweId": "CWE-522"
                    }
                ]
            }
        ]
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "Nozomi Networks",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Guardian",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_name": "0",
                                            "version_value": "23.4.1"
                                        }
                                    ]
                                }
                            },
                            {
                                "product_name": "CMC",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_name": "0",
                                            "version_value": "23.4.1"
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "references": {
        "reference_data": [
            {
                "url": "https://security.nozominetworks.com/NN-2023:17-01",
                "refsource": "MISC",
                "name": "https://security.nozominetworks.com/NN-2023:17-01"
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.1.0-dev"
    },
    "source": {
        "discovery": "EXTERNAL"
    },
    "work_around": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "<div><div>Nozomi Networks recommends creating specific users for OpenAPI usage, with only the necessary permissions to access the required data sources.<br>Additionally, it is advised to limit API keys to allowed IP addresses whenever possible.<br>Finally, it is also suggested to regenerate existing API keys periodically and to review sign-ins via API keys in the audit records.</div></div>"
                }
            ],
            "value": "Nozomi Networks recommends creating specific users for OpenAPI usage, with only the necessary permissions to access the required data sources.\nAdditionally, it is advised to limit API keys to allowed IP addresses whenever possible.\nFinally, it is also suggested to regenerate existing API keys periodically and to review sign-ins via API keys in the audit records."
        }
    ],
    "solution": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "<div><div>Upgrade to v23.4.1 or later.</div></div>"
                }
            ],
            "value": "Upgrade to v23.4.1 or later."
        }
    ],
    "credits": [
        {
            "lang": "en",
            "value": "This issue was reported by Maciej Kosz."
        }
    ],
    "impact": {
        "cvss": [
            {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
            }
        ]
    }
}