PT-2023-15910 · Sophos · Sophos Connect

CVE-2022-4901 · Publicado 2023-03-01 · Atualizado 2023-03-09

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sophos Connect versions prior to 2.2.90

Description The issue allows Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim. This is achieved through multiple stored XSS vulnerabilities.

Recommendations For Sophos Connect versions prior to 2.2.90, update to version 2.2.90 or later to resolve the issue. As a temporary workaround, consider restricting the loading of VPN configurations to trusted sources until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-4901

Produtos afetados

Sophos Connect

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-4901 · Nota de Segurança
• https://t.me/cibsecurity/59264 · Publicação no Telegram
• https://t.me/cvenotify/45856 · Publicação no Telegram
• https://sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-4901 · Aviso do Fabricante
• https://t.me/cvenotify/45293 · Publicação no Telegram