Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2017-18014

An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page (Control Center -> Log Viewer -> in the filter option "Web Server Protection") in the webadmin interface, and execute any action available to the webadmin of the firewall (e.g., creating a new user, enabling SSH, or adding an SSH authorized key). The WAF log page will execute the "User-Agent" parameter in the HTTP POST request.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 37.3%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
Products affected by CVE-2017-18014
  • Sophos » Xg Firewall » Version: N/A
    cpe:2.3:h:sophos:xg_firewall:-
  • Sophos » Sfos » Version: 15.01.0
    cpe:2.3:o:sophos:sfos:15.01.0
  • Sophos » Sfos » Version: 16.5
    cpe:2.3:o:sophos:sfos:16.5
  • Sophos » Sfos » Version: 17.0
    cpe:2.3:o:sophos:sfos:17.0


Products
Pricing
Contact Us

Shodan ® - All rights reserved