CVE-2023-5552

Summary

A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”.

Affected Software

Weaknesses

• CWE-200: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

ADP Enrichment

CVE Program Container

Additional References

• https://www.sophos.com/en-us/security-advisories/sophos-sa-20231017-spx-password

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://www.sophos.com/en-us/security-advisories/sophos-sa-20231017-spx-password

• ←Previous
• Next→