CVE-2013-2642: OS Command Injection
First published: Tue Mar 18 2014(Updated: )
Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter to the Block page, when using the user_workstation variable in a customized template, and remote authenticated users to execute arbitrary commands via shell metacharacters in the (2) url parameter to the Diagnostic Tools functionality or (3) entries parameter to the Local Site List functionality.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sophos Web Appliance Firmware | <=3.7.8.1 | |
| Sophos Web Appliance Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-2642?
CVE-2013-2642 is classified as a high-severity vulnerability due to its potential for arbitrary command execution.
How do I fix CVE-2013-2642?
To fix CVE-2013-2642, upgrade your Sophos Web Appliance to version 3.7.8.2 or later.
Who is affected by CVE-2013-2642?
CVE-2013-2642 affects users of Sophos Web Appliance versions prior to 3.7.8.2.
What kind of attacks are possible with CVE-2013-2642?
CVE-2013-2642 allows remote attackers to execute arbitrary commands on the vulnerable Sophos Web Appliance.
What products are impacted by CVE-2013-2642?
CVE-2013-2642 impacts Sophos Web Appliance firmware versions up to 3.7.8.1.
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/sophos
- canonical/sophos web appliance firmware
- version/sophos web appliance firmware/3.7.8.1