CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2020-9363
High (7.8) in sophos. EPSS 1.0% chance of exploitation in the next 30 days.
The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile, Intercept X Endpoint, Intercept X for Server, and Secure Web Gateway. NOTE: the vendor feels that this does not apply to endpoint-protection products because the virus would be detected upon extraction.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
- CWE
- CWE-436
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sophos:cloud_optix
- sophos:endpoint_protection
- sophos:intercept_x_endpoint
- sophos:intercept_x_for_server
- sophos:mobile
- sophos:secure_web_gateway
References
- https://blog.zoller.lu/p/release-mode-coordinated-disclosure-ref.html
- https://community.sophos.com/b/security-blog/posts/sophos-comments-to-cve-2020-9363
- https://blog.zoller.lu/p/release-mode-coordinated-disclosure-ref.html
- https://community.sophos.com/b/security-blog/posts/sophos-comments-to-cve-2020-9363