CVE Feed

    Dashboard / CVE / CVE-2021-25273

    CVE-2021-25273

    Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.

    Published:Jul 29, 2021
    Last Modified:Nov 21, 2024
    EPS:Jul 29, 2021
    EPSS Score:0.00135
    CVSS Score:4.8

    Affected Products

    Vendor
    Sophos
    Product
    Unified Threat Management

    Exploits

    http://seclists.org/fulldisclosure/2021/Dec/3http://seclists.org/fulldisclosure/2021/Dec/3

    Related CVEs

    CVE-2022-0652 (CVSS 3.3) — Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permi…
    CVE-2022-0386 (CVSS 8.8) — A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to ex…
    CVE-2020-25223 (CVSS 9.8) — A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, a…
    CVE-2016-0777 (CVSS 6.5) — The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows r…
    CVE-2014-2537 (CVSS 7.8) — Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denia…
    CVE-2012-3238 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gatewa…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High