Sensitive Password Exposure in Sophos UTM by Local Administrators
CVE-2016-7397

4.4MEDIUM

Key Information:

Vendor
Sophos
Status
Unified Threat Management Software
Vendor
CVE Published:
3 October 2016

Summary

The Frontend component of Sophos UTM versions 9.405-5 and earlier allows local administrators to access sensitive password information stored in the 'value' field of the SMTP user settings within the notifications configuration tab. This exposes critical information that could jeopardize network security. Admins should take immediate action by updating to patched versions and reviewing their configurations to safeguard against unauthorized access.

References

http://www.securitytracker.com/id/1036931
vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/93266
vdb-entryx_refsource_BID
http://www.securityfocus.com/archive/1/539518/100/0/threaded
mailing-listx_refsource_BUGTRAQ

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.