Cross site scripting

2023-03-0119:15:00

PRIOn knowledge base

www.prio-n.com

cross site scripting

sophos connect

vulnerabilities

older versions

nvd

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.3%

JSON

Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim.

CPENameOperatorVersion
connectlt2.2.90

CPE	Name	Operator	Version
	connect	lt	2.2.90

References

www.sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf