Sophos Web Appliance vulnerability exploited in the wild (CVE-2023-1671)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-2551 | Unauthenticated Remote Code Execution in Oracle WebLogic Server via IIOP | 9.8 | 93% | KEV | KEV |
| CVE-2023-1671 | Command Injection RCE in Sophos Web Appliance Warn-Proceed Handler | 9.8 | 100% | KEVPoC | KEV |
From the original article
2 min read at helpnetsecurity.com
CISA has added three vulnerabilities to its Known Exploited Vulnerabilities catalog, among them a critical vulnerability (CVE-2023-1671) in Sophos Web Appliance that has been patched by the company in April 2023. CVE-2023-1671 is a pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance that allows attackers to execute arbitrary code.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.