{"id":"CVE-2024-12729","published":"2024-12-19T20:58:52Z","modified":"2024-12-21T04:55:58Z","title":"A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in…","vendor":"Sophos","product":"Sophos Firewall","tier":"tail","description":{"text":"A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1).","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01306,"percentile":0.70437,"provenance":"source"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce","tags":[]}],"priority":{"score":20.2,"factors":[{"name":"EPSS percentile","points":14.09},{"name":"CVSS severity","points":6.16}]},"vendorSlug":"sophos","affectedVersions":[{"vendor":"Sophos","product":"Sophos Firewall","versions":["< 21.0 MR1 (21.0.1)"]}],"euvd":{"id":"EUVD-2024-51077","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-sophos-firewall-cwe-94"}}