High · 7.1 CVE-2023-5552 EUVD-2023-57852GHSA-m2g3-pg3w-frm3

A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sop…

Published Oct 17, 2023 · Updated Sep 13, 2024 · Assigned by Sophos

Vendor: Sophos Product: Sophos Firewall Category: Network devices

Description

A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”.

Affected products

Vendor	Product	Affected	Fixed
Sophos	Sophos Firewall	—	19.5.4

Advisories 1

WID-SEC-2023-2703 Sophos Firewall: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 17, 2023

References

https://www.sophos.com/en-us/security-advisories/sophos-sa-20231017-spx-password vendor-advisory