CVE-2022-0652 — Log File Information Exposure in Sophos UTM

CWE-532 — Log File Information ExposureCWE-732 — Incorrect Permission AssignmentCWE-307 — Improper Restriction of Excessive Authentication Attempts3 documents3 sources
Severity
7.8HIGHNVD
CNA3.3
EPSS
0.0%
top 87.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Sophos UTMSophos Unified Threat Management
Timeline
PublishedMar 22
Latest updateMar 23

Description

Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5sophos/sophos_utmunspecified — 9.710

🔴Vulnerability Details

2
GHSA
GHSA-45jp-55w8-4p9x: Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions↗2022-03-23
▶
CVEList
CVE-2022-0652: Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions↗2022-03-21
▶
CVE-2022-0652 — Log File Information Exposure in Sophos | cvebase