CVE-2022-3709

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
SophosSophos Firewall>= unspecified, < 19.5 GA; >= unspecified, < 19.0 MR2; >= unspecified, < 18.5 MR5

References

Timeline

Published
Dec 1, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-370909.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function Edit_BasicSSID.CVE-2022-370919.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function EditWlanMacList.CVE-2022-370929.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function SetAPWifiorLedInfoById.CVE-2022-370939.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function AddMacList.CVE-2022-370949.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function Edit_BasicSSID_5G.CVE-2022-370959.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function UpdateWanParams.CVE-2022-370969.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function EnableIpv6.CVE-2022-370979.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function SetAPInfoById.CVE-2022-370989.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function UpdateIpv6Params.CVE-2022-370999.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function UpdateSnat.CVE-2022-37102.7A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controCVE-2022-371009.8H3C H200 H200V100R004 was discovered to contain a stack overflow via the function UpdateMacClone.
CVE-2022-3709: High severity, CVSS 8.4 | Vulnix