CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2020-15504

CVSS 9.8v3.1pub. 2020-07-10upd. 2024-11-21

A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary code remotely. The fix is built into the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) and the v17.5 MR13 release. All other versions >= 17.0 have received a hotfix.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Sophos Xg Firewall Firmware

    OS
    Sophos
    17.518.017.0 – 17.5
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
SQLiFirewall
CWE
References

Related vulnerabilities

CVE-2020-15069CRITICAL9.8⚠ KEVPL ✓same product

Buffer Overflow w Sophos XG Firewall umożliwiający zdalne wykonanie kodu

CVE-2022-3226HIGH7.2same product

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sopho...

CVE-2022-3696HIGH7.2same product

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases...

CVE-2022-3713HIGH8.8same product

A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Fire...

CVE-2020-17352HIGH8.8same product

Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potential...