CVE-2013-2642: OS Command Injection
Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter to the Block page, when using the userworkstation variable in a customized template, and remote authenticated users to execute arbitrary commands via shell metacharacters in the (2) url parameter to the Diagnostic Tools functionality or (3) entries parameter to the Local Site List functionality.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2642?
CVE-2013-2642 is classified as a high-severity vulnerability due to its potential for arbitrary command execution.
How do I fix CVE-2013-2642?
To fix CVE-2013-2642, upgrade your Sophos Web Appliance to version 3.7.8.2 or later.
Who is affected by CVE-2013-2642?
CVE-2013-2642 affects users of Sophos Web Appliance versions prior to 3.7.8.2.
What kind of attacks are possible with CVE-2013-2642?
CVE-2013-2642 allows remote attackers to execute arbitrary commands on the vulnerable Sophos Web Appliance.
What products are impacted by CVE-2013-2642?
CVE-2013-2642 impacts Sophos Web Appliance firmware versions up to 3.7.8.1.