CVE-2020-9363

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 24-02-2020 05:15

Last modified: - 18-04-2022 05:13

Total changes: - 3

Description

The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile, Intercept X Endpoint, Intercept X for Server, and Secure Web Gateway. NOTE: the vendor feels that this does not apply to endpoint-protection products because the virus would be detected upon extraction.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Low

Attack complexity

Local

Attack vector

High

Availability

High

Confidentiality

High

Integrity

None

Privileges required

Unchanged

Scope

Required

User interaction

7.8

Base score

1.8

5.9

Exploitability score

Impact score

Verification logic

vendor=sophos AND product=cloud_optix AND versionEndExcluding=2020-01-14

vendor=sophos AND product=endpoint_protection AND versionEndExcluding=2020-01-14

vendor=sophos AND product=intercept_x_endpoint AND versionEndExcluding=2020-01-14

vendor=sophos AND product=intercept_x_for_server AND versionEndExcluding=2020-01-14

vendor=sophos AND product=mobile AND versionEndExcluding=2020-01-14

vendor=sophos AND product=secure_web_gateway AND versionEndExcluding=2020-01-14

Reference

Keywords

CVE-2020-9363

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2020-9363

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures