Lucene search

SophosCVELIST:CVE-2022-3980

HistoryNov 16, 2022 - 12:00 a.m.

CVE-2022-3980

2022-11-1600:00:00

Sophos

www.cve.org

sophos mobile

xee vulnerability

ssrf

code execution

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.368 Low

EPSS

Percentile

97.2%

JSON

An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.

CNA Affected

[
  {
    "vendor": "Sophos",
    "product": "Sophos Mobile managed on-premises",
    "versions": [
      {
        "version": "5.0.0",
        "status": "affected",
        "lessThan": "unspecified",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThanOrEqual": "9.7.4",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.368 Low

EPSS

Percentile

97.2%

JSON

Related for CVELIST:CVE-2022-3980