Reflected Cross-Site Scripting Vulnerability in Sophos Web Appliance
CVE-2023-33336

4.8MEDIUM

Key Information:

Vendor
Sophos
Status
Web Appliance
Vendor
CVE Published:
30 June 2023

Summary

A reflected cross-site scripting (XSS) vulnerability has been identified in Sophos Web Appliance version 4.3.9.1. This flaw allows attackers to input arbitrary code through the use of double quotes. Such vulnerabilities can be exploited to inject malicious scripts that, when executed in the context of an unsuspecting user's browser, could lead to unauthorized actions, session hijacking, or data theft. It is critical for users of this software to implement mitigations and ensure their systems are updated to protect against potential exploitation.

References

https://inf0seq.github.io/cve/2023/04/30/Cross-site-scrip...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.