CVE-2023-24471: 
NixOS vulnerability analysis and mitigation

An access control vulnerability (CVE-2023-24471) was discovered in Nozomi Networks Guardian and CMC versions prior to V22.6.2. The vulnerability was disclosed on August 9, 2023, and affects the debug functionality where restrictions applied to actual assertions are not properly enforced (Nozomi Advisory).

The vulnerability stems from incorrect authorization (CWE-863) in the debug functionality of the Query and Assertions functions. The CVSS v4.0 base score is 7.1 (HIGH) with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, while the CVSS v3.1 base score is 6.5 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (Nozomi Advisory).

The vulnerability allows an authenticated user with reduced visibility to obtain unauthorized information through the debug functionality. This enables access to data that would normally be restricted in the Query and Assertions functions (Nozomi Advisory).

Organizations can mitigate this vulnerability by using internal firewall features to limit access to the web management interface. The permanent solution is to upgrade to version 22.6.2 or later (Nozomi Advisory).