Skip to content
OpenAdvisories
Low · 3.3 CVE-2022-4901 EUVD-2022-52157GHSA-cq42-2gfv-949c

Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicio…

Published Mar 1, 2023 · Updated Mar 7, 2025 · Assigned by Sophos

Vendor: Sophos Product: Sophos Connect Client Category: Network devices

Description

Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim.

Affected products

VendorProductAffectedFixed
Sophos Sophos Connect Client unspecified – < 2.2.90 2.2.90

References