CVE-2017-6184
MEDIUMSophos Web Appliance < 4.3.1.2 - Remote Command Injection via Report Token Parameter
Title source: llmDescription
In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via the token parameter, aka NSWA-1303.
References (3)
Core 3
Core References
Release Notes, Vendor Advisory x_refsource_confirm
http://wsa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.2.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/97261
Vendor Advisory x_refsource_confirm
https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-v4-3-1-2
Scores
CVSS v3
4.7
EPSS
0.0122
EPSS Percentile
79.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Details
CWE
CWE-77
Status
published
Products (1)
sophos/web_appliance
< 4.3.1.1
Published
Mar 30, 2017
Tracked Since
Feb 18, 2026