CVE-2017-6184

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via the token parameter, aka NSWA-1303.

Metrics

CVSS 3.0 4.7/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://wsa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.2.htmlRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/97261
https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-v4-3-1-2Vendor Advisory
http://wsa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.2.htmlRelease Notes, Vendor Advisory
http://www.securityfocus.com/bid/97261
https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-v4-3-1-2Vendor Advisory

Timeline

Published: Mar 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-61866.7Code injection vulnerability in Bitdefender Total Security 12.0 (and earlier), Internet Security 12.0 (and earlier), and Antivirus Plus 12.0 CVE-2017-61879.8Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary code via a long URI i CVE-2017-61885.5Munin before 2.999.6 has a local file write vulnerability when CGI graphs are enabled. Setting multiple upper_limit GET parameters allows ov CVE-2017-61897.3Untrusted search path vulnerability in Amazon Kindle for PC before 1.19 allows local users to execute arbitrary code and conduct DLL hijacki CVE-2017-61907.5Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to CVE-2017-61917.8Buffer overflow in APNGDis 2.8 and below allows a remote attacker to execute arbitrary code via a crafted filename.CVE-2017-61925.5Buffer overflow in APNGDis 2.8 and earlier allows a remote attackers to cause denial of service and possibly execute arbitrary code via a cr CVE-2017-61935.5Buffer overflow in APNGDis 2.8 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a cr CVE-2017-61947.8The relocs function in libr/bin/p/bin_bflt.c in radare2 1.2.1 allows remote attackers to cause a denial of service (heap-based buffer overfl CVE-2017-61959.8Ipswitch MOVEit Transfer (formerly DMZ) allows pre-authentication blind SQL injection. The fixed versions are MOVEit Transfer 2017 9.0.0.201 CVE-2017-61967.8Multiple use-after-free vulnerabilities in the gx_image_enum_begin function in base/gxipixel.c in Ghostscript before ecceafe3abba2714ef9b432 CVE-2017-61975.5The r_read_* functions in libr/include/r_endian.h in radare2 1.2.1 allow remote attackers to cause a denial of service (NULL pointer derefer