CVE-2020-15504
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary code remotely. The fix is built into the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) and the v17.5 MR13 release. All other versions >= 17.0 have received a hotfix.
Una vulnerabilidad de inyección SQL en las interfaces web de usuario y administrador de Sophos XG Firewall versiones v18.0 MR1 y anteriores, permite potencialmente a un atacante ejecutar código arbitrario remotamente. La corrección está incorporada en el relanzamiento de XG Firewall versión v18 MR-1 (llamado MR-1-Build396) y la versión v17.5 MR13. Todas las demás versiones superiores a 17.0 incluyéndola, han recibido una revisión
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-07-02 CVE Reserved
- 2020-07-10 CVE Published
- 2023-03-26 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-via-sqli-cve-2020-15504 | 2020-07-14 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | >= 17.0 <= 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version " >= 17.0 <= 17.5" | - |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "17.5" | maintenance_release1 |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "17.5" | maintenance_release10 |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "17.5" | maintenance_release11 |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "17.5" | maintenance_release12 |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "17.5" | maintenance_release3 |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "17.5" | maintenance_release4 |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "17.5" | maintenance_release5 |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "17.5" | maintenance_release6 |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "17.5" | maintenance_release7 |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "17.5" | maintenance_release8 |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 17.5 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "17.5" | maintenance_release9 |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 18.0 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "18.0" | - |
Affected
| ||||||
| Sophos Search vendor "Sophos" | Xg Firewall Firmware Search vendor "Sophos" for product "Xg Firewall Firmware" | 18.0 Search vendor "Sophos" for product "Xg Firewall Firmware" and version "18.0" | maintenance_release1 |
Affected
| ||||||