PT-2023-2880 · Sophos · Sophos Web Appliance

Published 2023-04-04 · Updated 2025-02-11 · CVE-2020-36692

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Sophos Web Appliance versions older than 4.3.10.4

Description A reflected XSS via POST vulnerability in the report scheduler allows execution of JavaScript code in the victim's browser via a malicious form that must be manually submitted by the victim while logged in to SWA. This issue exists due to inadequate protection of the web page structure, potentially allowing a remote attacker to execute arbitrary JavaScript code using a specially crafted form.

Recommendations For Sophos Web Appliance versions older than 4.3.10.4, update to version 4.3.10.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the report scheduler to minimize the risk of exploitation. Avoid using malicious forms while logged in to SWA until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-02835

CVE-2020-36692

Affected Products

Sophos Web Appliance

References · 9

• https://bdu.fstec.ru/vul/2023-02835 · Security Note
• https://sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36692 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36692 · Vendor Advisory
• https://t.me/true_secator/4254 · Telegram Post
• https://t.me/cvenotify/47843 · Telegram Post
• https://t.me/cvenotify/47478 · Telegram Post
• https://t.me/cvenotify/110810 · Telegram Post
• https://t.me/cibsecurity/61380 · Telegram Post