CVE Feed

    Dashboard / CVE / CVE-2022-3710

    CVE-2022-3710

    A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall releases older than version 19.5 GA.

    Published:Dec 1, 2022
    Last Modified:Apr 23, 2025
    EPS:Dec 1, 2022
    EPSS Score:0.00215
    CVSS Score:2.7

    Affected Products

    Vendor
    Sophos
    Product
    Xg Firewall
    Vendor
    Sophos
    Product
    Xg Firewall Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2022-3713 (CVSS 8.8) — A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Fire…
    CVE-2022-3696 (CVSS 7.2) — A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases…
    CVE-2022-3709 (CVSS 6.8) — A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizar…
    CVE-2022-3711 (CVSS 4.3) — A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database co…
    CVE-2022-3226 (CVSS 7.2) — An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sopho…
    CVE-2020-15069 (CVSS 9.8) — Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S B…
    CVE-2020-11503 (CVSS 9.8) — A heap-based buffer overflow in the awarrensmtp component of Sophos XG Firewall v17.5 MR11 and older potential…
    CVE-2020-12271 (CVSS 9.8) — A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall dev…
    CVE-2018-16116 (CVSS 8.8) — SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remot…
    CVE-2018-16117 (CVSS 8.8) — A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High