CVE-2014-2850

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.

Metrics

CVSS 2.0 8.5/10AV:N/AC:M/Au:S/C:C/I:C/A:C

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/57706Vendor Advisory
http://www.exploit-db.com/exploits/32789Exploit
http://www.securityfocus.com/bid/66734
http://www.sophos.com/en-us/support/knowledgebase/120230.aspxVendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-14-069/
http://secunia.com/advisories/57706Vendor Advisory
http://www.exploit-db.com/exploits/32789Exploit
http://www.securityfocus.com/bid/66734
http://www.sophos.com/en-us/support/knowledgebase/120230.aspxVendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-14-069/

Timeline

Published: Apr 11, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-28516.9Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial o CVE-2014-28525.0OpenAFS before 1.6.7 delays the listen thread when an RXS_CheckResponse fails, which allows remote attackers to cause a denial of service (p CVE-2014-28534.3Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remot CVE-2014-28544.3Cross-site scripting (XSS) vulnerability in the SemanticTitle extension before 1.1.0 for MediaWiki allows remote attackers to inject arbitra CVE-2014-28557.8The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop a CVE-2014-28564.3Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to CVE-2014-28575.0The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 does not properly restrict acces CVE-2014-28585.0Directory traversal vulnerability in the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 through 2.3.6 allows remote attackers CVE-2014-28597.5PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to bypass intended access restrictions via a direct request.CVE-2014-28604.3Multiple cross-site scripting (XSS) vulnerabilities in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allow remote attackers to inje CVE-2014-28614.3Incomplete blacklist vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to conduct cross-site s CVE-2014-28626.5PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 does not check authorization in unspecified situations, which allows remote authentic