CVE-2023-5552

HIGH

Sophos Firewall < 19.5.3 - Password Disclosure via Secure PDF eXchange Feature

Title source: llm

Description

A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”.

References (1)

Core 1

Core References

Vendor Advisory vendor-advisory

https://www.sophos.com/en-us/security-advisories/sophos-sa-20231017-spx-password

Scores

CVSS v3 7.1

EPSS 0.0007

EPSS Percentile 20.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-522 CWE-200

Status published

Products (1)

sophos/firewall < 19.5.3

Published Oct 18, 2023

Tracked Since Feb 18, 2026