PT-2022-24997 · Sophos · Sophos Mobile

Florian Hauser · Published 2022-11-16 · Updated 2025-04-29 · CVE-2022-3980

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sophos Mobile versions 5.0.0 through 9.7.4

Description An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises. This issue may lead to significant security risks, including the execution of malicious code.

Recommendations For Sophos Mobile versions 5.0.0 through 9.7.4, update to a version that contains a fix for this issue to prevent potential code execution and server-side request forgery. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-3980

Affected Products

Sophos Mobile

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-3980 · Security Note
• https://sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3980 · Vendor Advisory
• https://t.me/cibsecurity/53028 · Telegram Post
• https://t.me/cvenotify/37870 · Telegram Post
• https://t.me/cvenotify/38017 · Telegram Post
• https://t.me/cvenotify/120164 · Telegram Post