CVE-2023-30802 MEDIUM

CVE-2023-30802: Sangfor Next-Gen Application Firewall Source Code Disclosure

Vendor Sangfor
Product Net-Gen Application Firewall
Weakness CWE-540
Published October 10, 2023
Last update November 28, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid Content-Length field.

Key dates

02Disclosure timeline

October 10, 2023 CVE published
November 28, 2025 Record updated