CVE-2018-9233

Description

Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%SophosSophos Anti-VirusConfigmachine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other approaches.

Risk Information

Base Score

7.8

MODERATE

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.055

Associated Vulnerability

Vulnerability	OS Platform
Update Symantec Endpoint Protection (x64) 10.7 to latest version	Windows
Update Symantec Endpoint Protection 10.7 to latest version	Windows
Vulnerabilities CVE-2018-4863 ,CVE-2018-9233 ,CVE-2020-9363 are affected in endpoint_protection 10.7	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234