CVE-2022-3711 - OpenCVE

A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than version 19.5 GA.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Sophos	Xg Firewall Xg Firewall Firmware

Configuration 1 [-]

AND

cpe:2.3:o:sophos:xg_firewall_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:sophos:xg_firewall:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0

History

No history.

MITRE

Status: PUBLISHED

Assigner: Sophos

Published: 2022-12-01T00:00:00

Updated: 2024-08-03T01:20:57.113Z

Reserved: 2022-10-27T00:00:00

Link: CVE-2022-3711

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-12-01T18:15:10.503

Modified: 2022-12-09T17:41:05.007

Link: CVE-2022-3711

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6847B871-B1A5-440F-8B11-93B77D9D13CC", "versionEndIncluding": "19.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:sophos:xg_firewall:-:*:*:*:*:*:*:*", "matchCriteriaId": "9628D079-44BD-479E-BE63-9BEF824B4E4B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than version 19.5 GA."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n SQL de solo lectura posterior a la autenticaci\u00f3n permite a los usuarios leer contenidos de bases de datos de configuraci\u00f3n no confidenciales en el Portal de usuario de versiones de Sophos Firewall anteriores a la versi\u00f3n 19.5 GA."}], "id": "CVE-2022-3711", "lastModified": "2022-12-09T17:41:05.007", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-alert@sophos.com", "type": "Secondary"}]}, "published": "2022-12-01T18:15:10.503", "references": [{"source": "security-alert@sophos.com", "tags": ["Vendor Advisory"], "url": "https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0"}], "sourceIdentifier": "security-alert@sophos.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}