critical10.0Public exploit code
CVE-2013-4983
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Sophos Web Protection Appliance - 'sblistpack' Arbitrary Command Execution (Metasploit)2013-09-17 · remote · linux · Verified
- Sophos Web Protection Appliance - Multiple Vulnerabilities2013-09-09 · webapps · linux · Verified
Impact
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to end-user/index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sophos | Web Appliance Firmware | through 3.7.9 Versions 3.7.8, 3.0.0, 3.0.1, 3.0.1.1, 3.0.2 |