8.8
HighCVSS 3.1 · from Sophos
CVE-2021-36807
An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8.
SG UTM · SQL injection · CWE-89AffectedSG UTM
FixUpdate to 9.708 MR8 or newer
PublishedNov 26, 2021, 14:12 · Sophos
ScoredNov 26, 2021 · 8.8 · Sophos
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8.
From Sophos
Affected and fixed versions
ProductAffectedFixed inSG UTMunspecified – before 9.708 MR89.708 MR8
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known