CVE-2024-12727 | THREATINT

Description

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode.

PUBLISHED Reserved 2024-12-17 | Published 2024-12-19 | Updated 2024-12-21 | Assigner Sophos

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status

unaffected

Any version before 21.0 MR1 (21.0.1)

affected

References

www.sophos.com/...ity-advisories/sophos-sa-20241219-sfos-rce

cve.org (CVE-2024-12727)

nvd.nist.gov (CVE-2024-12727)

Download JSON