CVE-2018-9233

Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it…

published April 5, 2018

CVSS
—
EPSS
2%
Percentile
76.2
In the wild
Unconfirmed
What it is

Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other approaches.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01650 · 76.2th percentile
Published
2018-04-05T17:00Z
EPSS history
Timeline
  • 05 APR 17:00Z
    Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it…
    cvelistv5