« Volver al listado

CVE-2020-17352

Estado: ModificadaAlta (8.8)—

Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely execute arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sophos — XG Firewall Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-17352",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-08-07T20:15:12.623",
  "references": [
    {
      "url": "https://community.sophos.com/b/security-blog",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://community.sophos.com/b/security-blog/posts/advisory-resolved-authenticated-rce-issues-in-user-portal-cve-2020-17352",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://community.sophos.com/b/security-blog",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://community.sophos.com/b/security-blog/posts/advisory-resolved-authenticated-rce-issues-in-user-portal-cve-2020-17352",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Dos vulnerabilidades de inyección de comandos de Sistema Operativo en el portal de Usuario de Sophos XG Firewall hasta el 05-08-2020, permiten potencialmente a un atacante autenticado ejecutar código arbitrario remotamente"
    }
  ],
  "lastModified": "2026-06-17T02:58:47.320",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3BBDD37-5675-43F6-A298-A1E7CBDC68EF"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AB6515B-F780-4B1B-BD1E-2EBEFCA09E4D"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AD1DF62-D9CF-40BD-B9F0-D66D8CF497A7"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF3BC5B5-9440-4B70-BD38-A7ABDE8EDF82"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF5A6965-C9DA-4D96-ABCC-2FA424B53C3C"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A73BC58-7D57-4699-8C1A-F260CA6893ED"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70FF0E57-77CA-4DC1-94EB-8728AAECE268"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B791A90-1286-4CBF-ADCE-E0B9D128DEB7"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A9EAA0D-D5A1-41C1-9EA1-9B4CFA0F8C4E"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3BD6BB0-8D01-4B33-8989-D424ABE9453D"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "496397CE-77F5-4773-A1AC-A05D34C697E6"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A3FA1DC-64AF-4557-B9EC-E1A0A07FACB5"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:18.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66BCC2C8-DDBD-4AF7-807A-BC9F5D4AC6E6"
            },
            {
              "criteria": "cpe:2.3:o:sophos:xg_firewall_firmware:18.0:mr1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0D55C63-0190-4F6D-BF8A-C135E0D2BDFA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}