CVE-2017-6412
HighSummary
In Sophos Web Appliance (SWA) before version 4.3.1.2, a Session Fixation vulnerability may occur, also known as NSWA-1310.
Risk Assessment
An attacker could exploit this vulnerability to hijack a user's session, potentially leading to unauthorized access to resources.
Recommendation
It is recommended to update the device to version 4.3.1.2 or later to mitigate the risk associated with this vulnerability.
Other vulnerabilities in Sophos Web Appliance
See all- CVE-2014-2850High
The network interface configuration page in Sophos Web Appliance before version 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.
- CVE-2014-2849High
The Change Password dialog box in Sophos Web Appliance before version 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.
- CVE-2013-2642High
Sophos Web Appliance versions before 3.7.8.2 allow remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter on the Block page and remote authenticated users to execute arbitrary commands via shell metacharacters in the url and entries parameters.
- CVE-2023-33336Medium
A reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via double quotes.
Original NVD description (English source)
In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310.