CVE-2016-7442

Name of the Vulnerable Software and Affected Versions Sophos UTM versions 9.405-5 and earlier

Description The issue allows local administrators to obtain sensitive password information. This is achieved by reading the value field of the proxy user settings in the "system settings / scan settings / anti spam" configuration tab.

Recommendations For Sophos UTM versions 9.405-5 and earlier, consider restricting access to the "system settings / scan settings / anti spam" configuration tab to minimize the risk of exploitation. As a temporary workaround, limit the privileges of local administrators until a fix is available.