PT-2021-16494 · Sophos · Sophos Utm

Daniel Hoffmann · Published 2021-07-29 · Updated 2021-12-16 · CVE-2021-25273

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Sophos UTM versions prior to 9.706

Description: The issue allows Stored XSS to execute as an administrator in the quarantined email detail view.

Recommendations: For Sophos UTM versions prior to 9.706, update to version 9.706 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25273

Affected Products

Sophos Utm

References · 7

• 🔥 http://seclists.org/fulldisclosure/2021/Dec/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25273 · Security Note
• https://community.sophos.com/utm-firewall/b/blog/posts/utm-up2date-9-706-released · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-25273 · Vendor Advisory
• https://t.me/cibsecurity/26583 · Telegram Post
• https://t.me/cvenotify/18340 · Telegram Post
• https://t.me/cvenotify/18694 · Telegram Post