Lucene search

K
cve[email protected]CVE-2022-3980
HistoryNov 16, 2022 - 1:15 p.m.

CVE-2022-3980

2022-11-1613:15:10
CWE-611
web.nvd.nist.gov
51
6
cve-2022-3980
xee vulnerability
sophos mobile
ssrf
code execution
nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.368 Low

EPSS

Percentile

97.2%

An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.

Affected configurations

NVD
Node
sophosmobileRange5.0.09.7.5
CPENameOperatorVersion
sophos:mobilesophos mobilelt9.7.5

CNA Affected

[
  {
    "vendor": "Sophos",
    "product": "Sophos Mobile managed on-premises",
    "versions": [
      {
        "version": "5.0.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThanOrEqual": "9.7.4",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Social References

More

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.368 Low

EPSS

Percentile

97.2%

Related for CVE-2022-3980