DeutschShown in its original language — a full translation is planned for a future version.
Sophos Firewall: Mehrere Schwachstellen
view advisory published 2022-12-01
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Sophos Firewall ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen oder Dateien zu manipulieren.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-3713US | high8.8 | — | ||
A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA. | ||||
| CVE-2022-3711US | medium4.3 | — | ||
A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than versi… | ||||
| CVE-2022-3710US | low2.7 | — | ||
A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall releases older t… | ||||
| CVE-2022-3709US | high8.4 | — | ||
A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA. | ||||
| CVE-2022-3696US | high7.2 | — | ||
A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA. | ||||
| CVE-2022-3226US | high7.2 | — | ||
An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA. | ||||
| CVE-2022-3236US | critical9.8OT critical | KEV | ||
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan