CVE-2022-0652

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-532 CWE-732

Affected software

Vendor	Product	Versions
Sophos	Sophos UTM	>= unspecified, < 9.710

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20220321-utm-9710Vendor Advisory
https://www.sophos.com/en-us/security-advisories/sophos-sa-20220321-utm-9710Vendor Advisory

Timeline

Published: Mar 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-06536.1The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient esca CVE-2022-06547.5Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0.CVE-2022-06567.5The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX acti CVE-2022-06579.8The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead id CVE-2022-06589.8The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (avail CVE-2022-06594.8The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perfo CVE-2022-06607.5Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.CVE-2022-06617.2The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a hi CVE-2022-06624.8The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cros CVE-2022-06634.8The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which cou CVE-2022-06649.8Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.CVE-2022-06656.5Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.