CVE-2022-4934 - A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code

Back Back to CVE browser

HIGH

A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code

Published Apr 4, 2023

7.2

HIGH

CVSS 3.1

EPSS 1.75%

Description

A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code.

Affected products

Vendor Sophos Product Sophos Web Appliance Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <4.3.10.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sophos

Sophos Web Appliance

n/a

Version	Status	Constraints
unspecified	affected	<4.3.10.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52188
Advisory
https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-52188		Advisory
https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce		Vendor Advisory