Sophos Web Appliance Command Injection Vulnerability

概要

参考情報

• packetstormsecurity.com/files/172016/Sophos-Web-Appliance-4.3.10.4-Command-Injection.html · Exploit
• sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce · Vendor Advisory
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2023-1671

web appliance のその他の脆弱性

• CVE-2023-33336中 4.8Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inpu…
• CVE-2022-4934高 7.2A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrator…
• CVE-2020-36692中 5.4A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScri…
• CVE-2017-9523中 6.1The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342.
• CVE-2017-6412高 8.1In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310.