CVE-2021-25273
MEDIUMCVSS 4.8/10EPSS 0.83%
Last modified
CVE-2021-25273 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.. EPSS estimates a 0.83% chance of exploitation in the next 30 days.
Description
Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sophos | Unified Threat Management | < 9.706 |
References
- https://seclists.org/fulldisclosure/2021/Dec/3Exploit, Mailing List, Third Party Advisory
- https://community.sophos.com/utm-firewall/b/blog/posts/utm-up2date-9-706-releasedRelease Notes, Vendor Advisory
- https://seclists.org/fulldisclosure/2021/Dec/3Exploit, Mailing List, Third Party Advisory
- https://community.sophos.com/utm-firewall/b/blog/posts/utm-up2date-9-706-releasedRelease Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-25273?
Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
How severe is CVE-2021-25273?
CVE-2021-25273 has a CVSS score of 4.8/10 (MEDIUM severity). The EPSS model estimates a 0.83% probability of exploitation in the next 30 days.
How do I fix CVE-2021-25273?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-25266An insecure data storage vulnerability allows a physical att…3.9
- CVE-2021-25267Multiple XSS vulnerabilities in Webadmin allow for privilege…8.4
- CVE-2021-25268Multiple XSS vulnerabilities in Webadmin allow for privilege…8.4
- CVE-2021-25269A local administrator could prevent the HMPA service from st…4.4
- CVE-2021-25270A local attacker could execute arbitrary code with administr…6.7
- CVE-2021-25271A local attacker could read or write arbitrary files with ad…6
- CVE-2021-25274The Collector Service in SolarWinds Orion Platform before 20…9.8
- CVE-2021-25275SolarWinds Orion Platform before 2020.2.4, as used by variou…7.8
- CVE-2021-25276In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a dire…7.1
- CVE-2021-25277FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the al…6.1
- CVE-2021-25278FTAPI 4.0 through 4.10 allows XSS via an SVG document to the…4.8
- CVE-2021-25281An issue was discovered in through SaltStack Salt before 300…9.8
Are you affected by CVE-2021-25273?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST