PT-2023-2216 · Sophos · Sophos Web Appliance

CVE-2022-4934 · Publicado 2023-03-28 · Atualizado 2025-02-11

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sophos Web Appliance versions prior to 4.3.10.4

Description A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance allows administrators to execute arbitrary code. The vulnerability is related to the failure to neutralize special elements when processing exceptions, which can be exploited by a remote attacker to execute arbitrary commands.

Recommendations For versions prior to 4.3.10.4, update to version 4.3.10.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the exception wizard to minimize the risk of exploitation.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2023-01964

CVE-2022-4934

Produtos afetados

Sophos Web Appliance

Referências · 9

• https://t.me/cvenotify/47845 · Publicação no Telegram
• https://t.me/cibsecurity/61377 · Publicação no Telegram
• https://sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-4934 · Nota de Segurança
• https://t.me/cvenotify/110811 · Publicação no Telegram
• https://t.me/true_secator/4254 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-4934 · Aviso do Fabricante
• https://t.me/cvenotify/47477 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-01964 · Nota de Segurança