Read the docs
TI-2022-04525 Aliases CVE-2022-4934GHSA-32v8-f8qr-4pv8

Command injection in Sophos Web Appliance

Priority LOW 37CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01752 78th percentileScored 2026-11-07
Fix Fixed Sophos Web Appliance (Sophos): 4.3.10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SophosSophos Web Appliancebefore 4.3.10.44.3.10.4Patch availableCNA
  • Sophos Web Appliance VendorSophos Affected before 4.3.10.4 Fixed in 4.3.10.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sophos:web_appliance:*:*:*:*:*:*:*:*before 4.3.10.4VulnerableSophos
  • cpe:2.3:a:sophos:web_appliance:*:*:*:*:*:*:*:* Versions before 4.3.10.4 Vulnerable ·Sophos

Remediation

  • Fix · CNA Sophos Web Appliance (Sophos) Fixed in 4.3.10.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sophos Web Appliance 4.3.10.4

    3 records Highest priority Priority CRITICAL 1 CRITICAL, 2 LOW

    Other records, highest priority first

    • TI-2023-01568 Command injection in Sophos Web AppliancePriority CRITICAL 100
    • TI-2020-18864 Cross-site scripting in Sophos Web AppliancePriority LOW 30
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4934
  2. 2026-10-03 Alias added: GHSA-32v8-f8qr-4pv8

References

Advisory 1

  • TI-2023-01568 Command injection in Sophos Web Appliance KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-02285 The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2… CVSS 2.0HIGH 8.5
  • TI-2014-02286 The network interface configuration page (netinterface) in Sophos Web Appliance before… CVSS 2.0HIGH 8.5
  • TI-2013-02325 Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2… CVSS 2.0MEDIUM 5.0
  • TI-2017-04046 In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface… CVSS 3.0CRITICAL 9.8
  • TI-2023-16494 Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance… CVSS 3.1MEDIUM 4.8
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences