CVE-2018-9233

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other approaches.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-916

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hyp3rlinx.altervista.org/advisories/SOPHOS-ENDPOINT-PROTECTION-CONTROL-PANEL-v10.7-INSECURE-CRYPTO-CVE-2018-9233.txtExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2018/Apr/7Exploit, Mailing List, Third Party Advisory
https://www.exploit-db.com/exploits/44411/Exploit, Third Party Advisory, VDB Entry
http://hyp3rlinx.altervista.org/advisories/SOPHOS-ENDPOINT-PROTECTION-CONTROL-PANEL-v10.7-INSECURE-CRYPTO-CVE-2018-9233.txtExploit, Third Party Advisory
http://seclists.org/fulldisclosure/2018/Apr/7Exploit, Mailing List, Third Party Advisory
https://www.exploit-db.com/exploits/44411/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Apr 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-92347.5GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in a CVE-2018-92356.1iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.CVE-2018-92365.4iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.CVE-2018-92375.4iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.CVE-2018-92386.1proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.CVE-2018-92407.5ncmpc through 0.29 is prone to a NULL pointer dereference flaw. If a user uses the chat screen and another client sends a long chat message,CVE-2018-92425.5The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an atta CVE-2018-92436.1GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge reques CVE-2018-92446.1GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones c CVE-2018-92459.8The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injection vulnerability in the User ID and password fields that allows users to bypas CVE-2018-92469.8The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable CVE-2018-92479.8The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL sta