CVE-2018-16118: OS Command Injection
Published Jun 20, 2019
·Updated
A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execute arbitrary OS commands via shell metachracters in the "X-Forwarded-for" HTTP header.
Affected Software
6 affected components
Sophos SFOS<=16.0
Sophos SFOS=16.5
Sophos SFOS=17.0
Sophos SFOS=17.0.8-mr8
Sophos SFOS=17.1
Sophos XG Firewall
Remediation
Event History
Jun 20, 2019
CVE Published
via MITRE·04:02 PM
Data Sourced
via MITRE·04:02 PM
Description
Frequently Asked Questions
1
What is CVE-2018-16118?
CVE-2018-16118 is a shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8.
2
How does CVE-2018-16118 impact Sophos XG firewall?
CVE-2018-16118 allows remote attackers to execute arbitrary OS commands via shell metachracters in the "X-Forwarded-for" HTTP header.
3
What is the severity of CVE-2018-16118?
CVE-2018-16118 has a severity rating of 8.1 (Critical).
4
Which versions of Sophos SFOS are affected by CVE-2018-16118?
CVE-2018-16118 affects Sophos SFOS versions 16.0, 16.5, 17.0, and 17.0.8 MR-8.
5
How can I fix CVE-2018-16118?
To fix CVE-2018-16118, it is recommended to update to the latest version of Sophos SFOS.