PT-2023-2510 · Sophos · Sophos Web Appliance

Publicado

2023-04-04

·

Atualizado

2025-03-13

·

CVE-2023-1671

CVSS v2.0

10

Crítica

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Sophos Web Appliance versions prior to 4.3.10.4
Description The issue is related to a lack of input sanitization in the warn-proceed handler component of Sophos Web Appliance, which can be exploited by a remote attacker to execute arbitrary commands. This is a pre-auth command injection vulnerability, allowing for the execution of arbitrary code.
Recommendations For versions prior to 4.3.10.4, update to version 4.3.10.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the warn-proceed handler to minimize the risk of exploitation.

Exploit

Correção

Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2023-02307
CVE-2023-1671

Produtos afetados

Sophos Web Appliance