CVE-2018-16118 - A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execute arbitrary OS commands via shell metachracters in the "X-Forwarded-for" HTTP header

Back Back to CVE browser

HIGH

A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execute arbitrary OS commands via shell metachracters in the "X-Forwarded-for" HTTP header

Published Jun 20, 2019

8.1

HIGH

CVSS 3.0

EPSS 3.72%

Description

A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execute arbitrary OS commands via shell metachracters in the "X-Forwarded-for" HTTP header.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (3)

https://community.sophos.com/kb/en-us/132637
x_refsource_CONFIRMVendor Advisory
https://github.com/klsecservices/Advisories/blob/master/KL-SOPHOS-2018-003.md
x_refsource_MISCPatchThird Party Advisory
https://www.sophos.com/en-us/legal/sophos-responsible-disclosure-policy.aspx
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://community.sophos.com/kb/en-us/132637		x_refsource_CONFIRMVendor Advisory
https://github.com/klsecservices/Advisories/blob/master/KL-SOPHOS-2018-003.md		x_refsource_MISCPatchThird Party Advisory
https://www.sophos.com/en-us/legal/sophos-responsible-disclosure-policy.aspx		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 20, 2019

Updated Aug 5, 2024

Reserved Aug 29, 2018

Link CVE-2018-16118

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-16118

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-16118