Lucene search

[email protected]CVE-2020-17352

HistoryAug 07, 2020 - 8:15 p.m.

CVE-2020-17352

2020-08-0720:15:12

CWE-78

[email protected]

web.nvd.nist.gov

cve-2020-17352

sophos xg firewall

command injection

user portal

remote code execution

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.7%

JSON

Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely execute arbitrary code.

Affected configurations

NVD

Node

sophosxg_firewall_firmwareMatch17.5-

sophosxg_firewall_firmwareMatch17.5maintenance_release1

sophosxg_firewall_firmwareMatch17.5maintenance_release10

sophosxg_firewall_firmwareMatch17.5maintenance_release11

sophosxg_firewall_firmwareMatch17.5maintenance_release12

sophosxg_firewall_firmwareMatch17.5maintenance_release3

sophosxg_firewall_firmwareMatch17.5maintenance_release4

sophosxg_firewall_firmwareMatch17.5maintenance_release5

sophosxg_firewall_firmwareMatch17.5maintenance_release6

sophosxg_firewall_firmwareMatch17.5maintenance_release7

sophosxg_firewall_firmwareMatch17.5maintenance_release8

sophosxg_firewall_firmwareMatch17.5maintenance_release9

sophosxg_firewall_firmwareMatch18.0-

sophosxg_firewall_firmwareMatch18.0mr1

CPENameOperatorVersion
sophos:xg_firewall_firmwaresophos xg firewall firmwareeq17.5
sophos:xg_firewall_firmwaresophos xg firewall firmwareeq18.0

CPE	Name	Operator	Version
sophos:xg_firewall_firmware	sophos xg firewall firmware	eq	17.5
sophos:xg_firewall_firmware	sophos xg firewall firmware	eq	18.0

References

community.sophos.com/b/security-blog

community.sophos.com/b/security-blog/posts/advisory-resolved-authenticated-rce-issues-in-user-portal-cve-2020-17352

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.7%

JSON

Related for CVE-2020-17352

cvelist1 nvd1 prion1