PT-2023-15689 · Sophos · Sophos Connect

Published 2023-03-01 · Updated 2023-03-09 · CVE-2022-48310

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sophos Connect versions prior to 2.2.90

Description An information disclosure issue allows sensitive key material to be included in technical support archives.

Recommendations For Sophos Connect versions prior to 2.2.90, update to version 2.2.90 or later to resolve the issue.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2022-48310

Affected Products

Sophos Connect

References · 5

• https://osv.dev/vulnerability/CVE-2022-48310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48310 · Security Note
• https://sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf · Vendor Advisory
• https://t.me/cibsecurity/59273 · Telegram Post
• https://t.me/cvenotify/45294 · Telegram Post