CVE-2023-5552
HIGHSophos Firewall < 19.5.3 - Information Disclosure
Title source: ruleDescription
A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”.
Scores
CVSS v3
7.1
EPSS
0.0007
EPSS Percentile
20.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Classification
CWE
CWE-522
CWE-200
Status
published
Affected Products (1)
sophos/firewall
< 19.5.3
Timeline
Published
Oct 18, 2023
Tracked Since
Feb 18, 2026