{"cve":"CVE-2022-3980","epss":{"score":0.08906},"mitre":{"cpes":[],"created":"2022-11-16T00:00:00+00:00","description":"An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"mitre_repo_path":"cves/2022/3xxx/CVE-2022-3980.json","references":["https://www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee"],"title":null,"updated":"2025-04-29T14:12:08.837000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:a:sophos:mobile:*:*:*:*:*:*:*:*"],"created":"2022-11-16T13:15:10.180000+00:00","description":"An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2022/CVE-2022-3980.json","references":["https://www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee"],"title":null,"updated":"2026-06-17T05:00:42.200000+00:00","vendors":["sophos","sophos$PRODUCT$mobile"],"weaknesses":["CWE-611"]},"opencve":{"changes":[{"created":"2025-04-29T15:15:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"4572734c-50ad-4f07-8628-d8ed93163da9"}],"cpes":{"data":["cpe:2.3:a:sophos:mobile:*:*:*:*:*:*:*:*"],"providers":["nvd"]},"created":{"data":"2022-11-16T00:00:00+00:00","provider":"mitre"},"description":{"data":"An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.08906},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee"],"providers":["mitre","nvd"]},"title":{"data":null,"provider":null},"updated":{"data":"2025-04-29T14:15:21.007000+00:00","provider":"nvd"},"vendors":{"data":["sophos","sophos$PRODUCT$mobile"],"providers":["nvd"]},"weaknesses":{"data":["CWE-611"],"providers":["nvd","vulnrichment"]}},"vulnrichment":{"cpes":[],"created":"2022-11-16T00:00:00+00:00","description":"An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"references":[],"title":null,"updated":"2025-04-29T14:10:38.475000+00:00","vendors":[],"vulnrichment_repo_path":"2022/3xxx/CVE-2022-3980.json","weaknesses":["CWE-611"]}}