PT-2017-16932 · Sophos · Sophos Web Appliance

Published 2017-03-30 · Updated 2017-04-04 · CVE-2017-6183

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sophos Web Appliance versions prior to 4.3.1.2

Description The issue concerns a remote command injection in a section of the machine's configuration utilities for adding and detecting Active Directory servers.

Recommendations For versions prior to 4.3.1.2, update to version 4.3.1.2 or later to resolve the issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2017-6183

Affected Products

Sophos Web Appliance

References · 5

• https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-v4-3-1-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6183 · Security Note
• http://wsa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.2.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6183 · Vendor Advisory
• http://securityfocus.com/bid/97261 · Note