{"id":"CVE-2022-3980","published":"2022-11-16T00:00:00Z","modified":"2025-04-29T14:12:08Z","title":"An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in…","vendor":"Sophos","product":"Sophos Mobile managed on-premises","tier":"core","eol":null,"affectedVersions":[{"vendor":"Sophos","product":"Sophos Mobile managed on-premises","versions":[">= 5.0.0, < unspecified",">= unspecified, <= 9.7.4"]}],"description":{"text":"An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.","provenance":"source","from":"CVE.org"},"summary":{"text":"An XML External Entity (XEE) vulnerability in Sophos Mobile managed on-premises, affecting versions 5.0.0 through 9.7.4, is caused by improper restriction of XML external entity references. An attacker with network access to the affected server can exploit it without authentication or user interaction to perform server-side request forgery and potentially execute code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:55Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.09785,"percentile":0.95533,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-11-13","exploitedFirstSeen":"2023-11-13","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2022-3980","date":"2023-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-25&host_type=src&vulnerability=cve-2022-3980","date":"2023-12-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2022-3980","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2022-3980","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-27&host_type=src&vulnerability=cve-2022-3980","date":"2024-01-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-28&host_type=src&vulnerability=cve-2022-3980","date":"2024-01-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-30&host_type=src&vulnerability=cve-2022-3980","date":"2024-01-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-07&host_type=src&vulnerability=cve-2022-3980","date":"2024-02-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-08&host_type=src&vulnerability=cve-2022-3980","date":"2024-02-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-09&host_type=src&vulnerability=cve-2022-3980","date":"2024-02-09"}],"evidenceTotal":528,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"references":[{"url":"https://www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-43309","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-43309","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2022-3980","name":"Sophos Mobile managed on-premises - XML External Entity Injection","severity":"critical","path":"http/cves/2022/CVE-2022-3980.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3980.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-11-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-3980","provenance":"source"},{"date":"2023-11-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2022-3980","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1083 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.11,"detail":"percentile 0.9553"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}