CVE-2017-6184
MEDIUMSophos Web Appliance < 4.3.1.1 - Command Injection
Title source: ruleDescription
In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via the token parameter, aka NSWA-1303.
Scores
CVSS v3
4.7
EPSS
0.0122
EPSS Percentile
78.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Classification
CWE
CWE-77
Status
published
Affected Products (2)
sophos/web_appliance
< 4.3.1.1
n/a/n/a
Timeline
Published
Mar 30, 2017
Tracked Since
Feb 18, 2026