PT-2023-32171 · Sophos · Sophos Firewall

Published 2023-10-17 · Updated 2023-10-25 · CVE-2023-5552

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sophos Firewall versions 19.5 MR3 (19.5.3) and older

Description A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs, if the password type is set to “Specified by sender”.

Recommendations For Sophos Firewall versions 19.5 MR3 (19.5.3) and older, consider updating to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to the Secure PDF eXchange (SPX) feature until a patch is available. Avoid using the password type set to “Specified by sender” in the affected feature until the issue is resolved.

Fix

Insufficiently Protected Credentials

Information Disclosure

Weakness Enumeration

CWE-522

CWE-200

Related Identifiers

CVE-2023-5552

Affected Products

Sophos Firewall

References · 14

• https://osv.dev/vulnerability/CVE-2023-5552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5552 · Security Note
• https://sophos.com/en-us/security-advisories/sophos-sa-20231017-spx-password · Vendor Advisory
• https://twitter.com/fridaysecurity/status/1714940261355200617 · Twitter Post
• https://twitter.com/pravin_karthik/status/1716362600470950089 · Twitter Post
• https://twitter.com/cracbot/status/1715064533310456232 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1714514574735544751 · Twitter Post
• https://twitter.com/Komodosec/status/1715166479652729167 · Twitter Post
• https://t.me/pentestingnews/40299 · Telegram Post
• https://twitter.com/moton/status/1715012779651084438 · Twitter Post
• https://twitter.com/CVEnew/status/1714425747581092041 · Twitter Post
• https://t.me/cibsecurity/72479 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1714939022093726054 · Twitter Post
• https://t.me/cvenotify/59637 · Telegram Post