{"id":"CVE-2013-4984","aliases":["EUVD-2013-4828","GHSA-j4hc-vcc8-346x"],"status":"published","title":"The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9...","description":"The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell metacharacters in the second argument.","severity":{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08128,"percentile":0.94878,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-264","CWE-78"],"published":"2013-09-10T10:00:00Z","modified":"2026-06-16T23:58:12Z","exploits":[{"source":"exploitdb","id":"EDB-28175","title":"Sophos Web Protection Appliance - Multiple Vulnerabilities","type":"webapps","platform":"linux","date":"2013-09-09","verified":true,"url":"https://www.exploit-db.com/exploits/28175"},{"source":"exploitdb","id":"EDB-28332","title":"Sophos Web Protection Appliance - clear_keys.pl Privilege Escalation (Metasploit)","type":"local","platform":"linux","date":"2013-09-17","verified":true,"url":"https://www.exploit-db.com/exploits/28332"},{"source":"metasploit","id":"exploit/linux/local/sophos_wpa_clear_keys","title":"Sophos Web Protection Appliance clear_keys.pl Local Privilege Escalation","type":"exploit","platform":"Linux","date":"2013-09-06","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/local/sophos_wpa_clear_keys"}],"products":[{"vendor":"sophos","product":"web_appliance"}],"references":[{"url":"http://www.coresecurity.com/advisories/sophos-web-protection-appliance-multiple-vulnerabilities","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Vendor Advisory"]},{"url":"http://www.sophos.com/en-us/support/knowledgebase/119773.aspx","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4984"},{"url":"https://github.com/advisories/GHSA-j4hc-vcc8-346x"}],"sources":{"cve":[{"id":"CVE-2013-4984","description":"The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell metacharacters in the second argument.","status":"published","published":"2013-09-10T10:00:00Z","modified":"2024-09-16T19:04:18.463Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4828","description":"The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell metacharacters in the second argument.","status":"published","published":"2013-09-10T10:00:00Z","modified":"2024-09-16T19:04:18Z","updated_at":"2026-11-03T00:55:26.73018Z"}],"ghsa":[{"id":"GHSA-j4hc-vcc8-346x","title":"The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9...","description":"The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell metacharacters in the second argument.","status":"published","published":"2022-05-17T03:47:32Z","modified":"2025-04-11T04:13:28Z","cwes":["CWE-78"],"updated_at":"2026-11-02T15:01:14.490744Z"}],"nvd":[{"id":"CVE-2013-4984","description":"The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell metacharacters in the second argument.","status":"published","published":"2013-09-10T11:28:41.073Z","modified":"2026-06-16T23:58:12.5Z","cvss":[{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78","CWE-264"],"updated_at":"2026-11-02T14:02:35.248411Z"}]}}