CVE-2020-15504: SQL Injection
First published: Fri Jul 10 2020(Updated: )
A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary code remotely. The fix is built into the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) and the v17.5 MR13 release. All other versions >= 17.0 have received a hotfix.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sophos Xg Firewall Firmware | >=17.0<=17.5 | |
| Sophos Xg Firewall Firmware | =17.5-maintenance_release1 | |
| Sophos Xg Firewall Firmware | =17.5-maintenance_release10 | |
| Sophos Xg Firewall Firmware | =17.5-maintenance_release11 | |
| Sophos Xg Firewall Firmware | =17.5-maintenance_release12 | |
| Sophos Xg Firewall Firmware | =17.5-maintenance_release3 | |
| Sophos Xg Firewall Firmware | =17.5-maintenance_release4 | |
| Sophos Xg Firewall Firmware | =17.5-maintenance_release5 | |
| Sophos Xg Firewall Firmware | =17.5-maintenance_release6 | |
| Sophos Xg Firewall Firmware | =17.5-maintenance_release7 | |
| Sophos Xg Firewall Firmware | =17.5-maintenance_release8 | |
| Sophos Xg Firewall Firmware | =17.5-maintenance_release9 | |
| Sophos Xg Firewall Firmware | =18.0 | |
| Sophos Xg Firewall Firmware | =18.0-maintenance_release1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-15504?
CVE-2020-15504 is a SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older.
How severe is CVE-2020-15504?
CVE-2020-15504 has a severity score of 9.8, which is classified as critical.
How can an attacker exploit CVE-2020-15504?
An attacker can exploit CVE-2020-15504 by running arbitrary code remotely through the SQL injection vulnerability.
Which versions of Sophos XG Firewall are affected by CVE-2020-15504?
Sophos XG Firewall v18.0 MR1 and older versions, including v17.5, are affected by CVE-2020-15504.
How can I fix CVE-2020-15504?
To fix CVE-2020-15504, update to the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) or the v17.5 MR13 release.
- collector/nvd-index
- vendor/sophos
- canonical/sophos xg firewall firmware
- version/sophos xg firewall firmware/17.0
- version/sophos xg firewall firmware/17.5
- version/sophos xg firewall firmware/17.5-maintenance_release1
- version/sophos xg firewall firmware/17.5-maintenance_release10
- version/sophos xg firewall firmware/17.5-maintenance_release11
- version/sophos xg firewall firmware/17.5-maintenance_release12
- version/sophos xg firewall firmware/17.5-maintenance_release3
- version/sophos xg firewall firmware/17.5-maintenance_release4
- version/sophos xg firewall firmware/17.5-maintenance_release5
- version/sophos xg firewall firmware/17.5-maintenance_release6
- version/sophos xg firewall firmware/17.5-maintenance_release7
- version/sophos xg firewall firmware/17.5-maintenance_release8
- version/sophos xg firewall firmware/17.5-maintenance_release9
- version/sophos xg firewall firmware/18.0
- version/sophos xg firewall firmware/18.0-maintenance_release1