Skip to Content
Get started
Open search
Back to Security Advisories
Informational

High

Resolved Post-auth SQLi in Capsule8 Console (CVE-2022-0366)

CVE(S)

CVE-2022-0366

PRODUCT(S)

Capsule8 Console

Updated

2022 Feb 1

Article Version

1

First Published

2022 Feb 1

Publication ID

sophos-sa-20220201-cap8-console-sqli

Workaround

No

Overview

A post-auth SQL injection vulnerability in the Capsule8 Console was discovered by Sophos during internal security testing. The vulnerability has been fixed.

The remediation prevented a previously authorized agent from gaining administrative access on Console.

Applies to the following Sophos product(s) and version(s)

  • Capsule8 Console versions 4.6.0 through 4.9.1 inclusive

Remediation

  • Fix included in Capsule8 Console 4.10.0 on February 1, 2022

  • Users of older versions of Capsule8 Console are required to upgrade to receive this fix

  • Sophos always recommends that Capsule8 customers upgrade to the latest available release at their earliest opportunity

Sophos Logo

Sophos Responsible Disclosure Policy

To learn about Sophos security vulnerability disclosure policies and publications, see the Responsible Disclosure Policy.

Resolved Post-auth SQLi in Capsule8 Console (CVE-2022-0366) | Sophos