certfr_avis - certfr-2022-avi-853

CERTFR-2022-AVI-853

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans Sophos Firewall. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Sophos indique que la vulnérabilité CVE-2022-3236 est activement exploitée dans le cadre d'attaques ciblées.

De plus, le portail utilisateur ainsi que l'interface de gestion ne devraient pas être accessibles sur Internet.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Sophos Firewall versions antérieures à v18.5 MR5 (18.5.5), v19.0 MR2 (19.0.2) et v19.5 GA
Sophos Firewall versions v19.0 GA, MR1 et MR1-1 sans le correctif de sécurité du 21 septembre 2022
Sophos Firewall versions v18.5 GA, MR1, MR1-1, MR2, MR3 et MR4 sans le correctif de sécurité du 21 septembre 2022
Sophos Firewall versions v18.0 MR3, MR4, MR5 et MR6 sans le correctif de sécurité du 23 septembre 2022
Sophos Firewall versions v17.5 MR12, MR13, MR14, MR15, MR16 et MR17 sans le correctif de sécurité du 23 septembre 2022
Sophos Firewall version v17.0 MR10 sans le correctif de sécurité du 23 septembre 2022

Sophos indique que, par défaut, les pare-feux se mettent à jour automatiquement.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Sophos sophos-sa-20220923-sfos-rce du 23 septembre 2022

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cul\u003e \u003cli\u003eSophos Firewall versions ant\u00e9rieures \u00e0\u00a0v18.5 MR5 (18.5.5), v19.0 MR2 (19.0.2) et v19.5 GA\u003c/li\u003e \u003cli\u003eSophos Firewall versions\u00a0v19.0 GA, MR1 et MR1-1 sans le correctif de s\u00e9curit\u00e9 du 21 septembre 2022\u003c/li\u003e \u003cli\u003eSophos Firewall versions v18.5 GA, MR1, MR1-1, MR2, MR3 et MR4\u00a0sans le correctif de s\u00e9curit\u00e9 du 21 septembre 2022\u003c/li\u003e \u003cli\u003eSophos Firewall versions v18.0 MR3, MR4, MR5 et MR6\u00a0sans le correctif de s\u00e9curit\u00e9 du 23 septembre 2022\u003c/li\u003e \u003cli\u003eSophos Firewall versions\u00a0v17.5 MR12, MR13, MR14, MR15, MR16 et MR17\u00a0sans le correctif de s\u00e9curit\u00e9 du 23 septembre 2022\u003c/li\u003e \u003cli\u003eSophos Firewall version v17.0 MR10\u00a0sans le correctif de s\u00e9curit\u00e9 du 23 septembre 2022\u003c/li\u003e \u003c/ul\u003e \u003cp\u003eSophos indique que, par d\u00e9faut, les pare-feux se mettent \u00e0 jour automatiquement.\u003c/p\u003e ",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-3236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3236"
    }
  ],
  "initial_release_date": "2022-09-26T00:00:00",
  "last_revision_date": "2023-12-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-853",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-09-26T00:00:00.000000"
    },
    {
      "description": "Correction coquille.",
      "revision_date": "2023-12-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Sophos Firewall. Elle permet \u00e0\nun attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n\nSophos indique que la vuln\u00e9rabilit\u00e9\u00a0CVE-2022-3236 est activement\nexploit\u00e9e dans le cadre d\u0027attaques cibl\u00e9es.\n\nDe plus, le portail utilisateur ainsi que l\u0027interface de gestion ne\ndevraient pas \u00eatre accessibles sur Internet.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Sophos Firewall",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Sophos sophos-sa-20220923-sfos-rce du 23 septembre 2022",
      "url": "https://www.sophos.com/fr-fr/security-advisories/sophos-sa-20220923-sfos-rce"
    }
  ]
}

CVE-2022-3236 (GCVE-0-2022-3236)

Vulnerability from cvelistv5

Published

2022-09-23 12:50

Modified

2025-10-21 23:15

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Summary

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

References

URL

Tags

https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Sophos	Sophos Firewall	Version: unspecified < Version: unspecified <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.526Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-3236",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-28T21:40:50.761466Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-09-23",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3236"
              },
              "type": "kev"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:15:34.699Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-3236"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-09-23T00:00:00+00:00",
            "value": "CVE-2022-3236 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Sophos Firewall",
          "vendor": "Sophos",
          "versions": [
            {
              "lessThanOrEqual": "18.5 MR4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "19.0 MR1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-23T12:50:13.000Z",
        "orgId": "526a354d-e866-4174-ae7d-bac848e5c4c5",
        "shortName": "Sophos"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-alert@sophos.com",
          "ID": "CVE-2022-3236",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Sophos Firewall",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_value": "18.5 MR4"
                          },
                          {
                            "version_affected": "\u003c=",
                            "version_value": "19.0 MR1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Sophos"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce",
              "refsource": "CONFIRM",
              "url": "https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "526a354d-e866-4174-ae7d-bac848e5c4c5",
    "assignerShortName": "Sophos",
    "cveId": "CVE-2022-3236",
    "datePublished": "2022-09-23T12:50:13.000Z",
    "dateReserved": "2022-09-17T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:15:34.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2022-AVI-853

Vulnerability from certfr_avis

Solution

CVE-2022-3236 (GCVE-0-2022-3236)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature