Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Sophos Connect Client 2.2.90 Clear all filters
TI-2022-23926 CVE-2022-48310 · GHSA-ffx9-rf8p-2px9

Cleartext storage of sensitive information in Sophos Connect Client

Priority LOW 24

An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00128 Published 2023-03-01 Fixed in 2.2.90 CWE-312
TI-2022-23925 CVE-2022-48309 · GHSA-jmc8-jw39-cq2w

Cross-site request forgery in Sophos Connect Client

Priority LOW 20

A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00343 Published 2023-03-01 Fixed in 2.2.90 CWE-352
TI-2022-04492 CVE-2022-4901 · GHSA-cq42-2gfv-949c

Cross-site scripting in Sophos Connect Client

Priority LOW 27

Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00337 Published 2023-03-01 Fixed in 2.2.90 CWE-79