CVE-2018-9233: sophos endpoint_protection

Vulnerability summary

CVE-2018-9233 is a high (CVSS 7.8) vulnerability in sophos endpoint_protection. EPSS estimates a 1.65% chance of exploitation in the next 30 days, higher than 76.1% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 05-04-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other approaches.

• CWE-916Use of Password Hash With Insufficient Computational EffortThe product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.