CVE-2017-6182

Опубликовано: 30 мар. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via functions, aka NSWA-1304.

Ссылки

http://wsa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.2.html
Release Notes
Vendor Advisory
http://www.securityfocus.com/bid/97261
https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-v4-3-1-2
Vendor Advisory
https://www.exploit-db.com/exploits/42332/
http://wsa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.1.2.html
Release Notes
Vendor Advisory
http://www.securityfocus.com/bid/97261
https://community.sophos.com/products/web-appliance/b/blog/posts/release-of-swa-v4-3-1-2
Vendor Advisory
https://www.exploit-db.com/exploits/42332/

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sophos:web_appliance:*:*:*:*:*:*:*:*

Версия до 4.3.1.1 (включая)

EPSS

Процентиль: 94%

0.1487

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-m6xg-v873-824r