CVE-2023-30802
Sangfor Next-Gen Application Firewall Source Code Disclosure
MEDIUM 5.3EPSS 0.8%
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid Content-Length field.
- Affected
- Sangfor · Net-Gen Application Firewall
- CVSS v3.1 NVD
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - EPSS
- 0.81% chance of exploitation in the next 30 days, 56th percentile
- Published
- 2023-10-10
- Updated
- 2025-11-28
Proof-of-concept exploits (1)
Security advisories
- https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sa…
- https://vulncheck.com/advisories/sangfor-ngaf-source
- https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4