|Topic||DoS via SAML configuration in Guardian/CMC before 22.6.2|
|CWE Impact||CWE-20: Improper Input Validation|
|Affects||Guardian, CMC < v22.6.2|
|CVE Risk Level||Medium|
|Risk Level for Nozomi customers||Medium|
An authenticated administrator can upload a SAML configuration file with the wrong format, with the application not checking the correct file format. Every subsequent application request will return an error.
The whole application in rendered unusable until a console intervention.
Guardian, CMC < v22.6.2
Use internal firewall features to limit access to the web management interface.
Upgrade to v22.6.2 or later.
We thank the following parties for their efforts: