What’s Vulnerable › Vulnerabilities
CVE-2017-18014
- Severity: medium (CVSS 6.1 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2018-01-12 · updated 2026-06-17
- Weakness: CWE-79
Description
An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page (Control Center -> Log Viewer -> in the filter option "Web Server Protection") in the webadmin interface, and execute any action available to the webadmin of the firewall (e.g., creating a new user, enabling SSH, or adding an SSH authorized key). The WAF log page will execute the "User-Agent" parameter in the HTTP POST request.
Affected products
- Sophos Firewall: through 17.0; 17.0-mr1, 17.0-mr2, 17.0-mr3
References
- http://seclists.org/fulldisclosure/2018/Jan/24
- https://blogs.securiteam.com/index.php/archives/3612
- https://community.sophos.com/kb/en-us/128024
- https://community.sophos.com/products/xg-firewall/b/xg-blog/posts/sfos-17-0-3-mr3-released
- http://seclists.org/fulldisclosure/2018/Jan/24
- https://blogs.securiteam.com/index.php/archives/3612
- https://community.sophos.com/kb/en-us/128024
- https://community.sophos.com/products/xg-firewall/b/xg-blog/posts/sfos-17-0-3-mr3-released
Get alerted when CVE-2017-18014 or the next vulnerability affects your stack