Unscored severity · published Mar 18, 2014
CVE-2013-2641
Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via the id parameter
–
CVSS
71%
EPSS
No
On KEV
Description
Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via the id parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)71.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Web Appliance · Sophos
All versions, or not specified · source: NVD
WA
Web Appliance Firmware · Sophos
through 3.7.8.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2641
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2641
Vendor Advisory
http://www.sophos.com/en-us/support/knowledgebase/118969.aspx
Exploit
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130403-0_Sophos_Web_Protection_Appliance_Multiple_Vulnerabilities.txt
More from Web Appliance
9.8
CVE-2023-1671
Sophos Web Appliance Command Injection Vulnerability
9.8
CVE-2017-6182
In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via functions, aka…
8.1
CVE-2017-6412
In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310
7.2
CVE-2022-4934
A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code
7.2
CVE-2017-6183
In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's configuration utilities for adding (and detecting) Active Directory servers was vulnerable to remote…