CSRF Vulnerability in Sophos Connect
CVE-2022-48309

4.3MEDIUM

Key Information:

Vendor
Sophos
Status
Sophos Connect Client
Vendor
CVE Published:
1 March 2023

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in Sophos Connect, enabling attackers to exploit this issue to access sensitive logs and technical support archives. This flaw affects versions of the software prior to 2.2.90, posing a risk of unauthorized information disclosure. Users are encouraged to update to the latest version to mitigate potential risks.

Affected Version(s)

Sophos Connect Client < 2.2.90

References

https://www.sophos.com/en-us/security-advisories/sophos-s...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mario Melcher - Information Security Professional at SEITENBAU GmbH
.