Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Sophos Web Appliance 4.3.10.4 Clear all filters
TI-2023-01568 CVE-2023-1671 · GHSA-5f37-m2hf-qphr

Command injection in Sophos Web Appliance

Priority CRITICAL 100KEV

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2023-04-04 Fixed in 4.3.10.4 CWE-77
TI-2022-04525 CVE-2022-4934 · GHSA-32v8-f8qr-4pv8

Command injection in Sophos Web Appliance

Priority LOW 37

A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01752 Published 2023-04-04 Fixed in 4.3.10.4 CWE-77
TI-2020-18864 CVE-2020-36692 · GHSA-g76m-97q8-j2jw

Cross-site scripting in Sophos Web Appliance

Priority LOW 30

A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victim browser via a malicious form that must be manually submitt…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00566 Published 2023-04-04 Fixed in 4.3.10.4 CWE-79