CVE:CVE-2020-15504
CNNVD:CNNVD-202007-519
Sophos XG Firewall是英国Sophos公司的一款下一代端点保护与企业级防火墙产品。
Sophos XG Firewall 18.0 MR1及之前版本中的用户和管理员Web界面存在SQL注入漏洞。远程攻击者可利用该漏洞执行任意代码。
solution:Upgrade sophos xg_firewall_firmware to a higher version than 17.5,17.5:maintenance_release1,17.5:maintenance_release10,17.5:maintenance_release11,17.5:maintenance_release12,17.5:maintenance_release3,17.5:maintenance_release4,17.5:maintenance_release5,17.5:maintenance_release6,17.5:maintenance_release7,17.5:maintenance_release8,17.5:maintenance_release9,18.0,18.0:maintenance_release1,and avoid the version [17.0,17.5],17.5:maintenance_release1,17.5:maintenance_release10,17.5:maintenance_release11,17.5:maintenance_release12,17.5:maintenance_release3,17.5:maintenance_release4,17.5:maintenance_release5,17.5:maintenance_release6,17.5:maintenance_release7,17.5:maintenance_release8,17.5:maintenance_release9,18.0,18.0:maintenance_release1