CVE-2014-2849
HighSummary
The Change Password dialog box in Sophos Web Appliance before version 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.
Risk Assessment
This vulnerability may lead to unauthorized changes to the admin password, compromising the security of the entire system.
Recommendation
It is recommended to upgrade to version 3.8.2 or later to mitigate this vulnerability.
Other vulnerabilities in Sophos Web Appliance
See all- CVE-2017-6412High
In Sophos Web Appliance (SWA) before version 4.3.1.2, a Session Fixation vulnerability may occur, also known as NSWA-1310.
- CVE-2014-2850High
The network interface configuration page in Sophos Web Appliance before version 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.
- CVE-2013-2642High
Sophos Web Appliance versions before 3.7.8.2 allow remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter on the Block page and remote authenticated users to execute arbitrary commands via shell metacharacters in the url and entries parameters.
- CVE-2023-33336Medium
A reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via double quotes.
Original NVD description (English source)
The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.