CVE-2017-6184: Sophos Web Appliance

Medium severity, CVSS 4.7. EPSS: 2.5% chance of exploitation in the next 30 days.

In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via the token parameter, aka NSWA-1303.

Affected products

• Sophos Web Appliance: up to and including 4.3.1.1

Published 2017-03-30. Last modified 2026-06-17.