High severity8.6NVD Advisory· Published Aug 10, 2016· Updated Jun 17, 2026

CVE-2016-6597

Description

Sophos EAS Proxy before 6.2.0 for Sophos Mobile Control, when Lotus Traveler is enabled, allows remote attackers to access arbitrary web-resources from the backend mail system via a request for the resource, aka an Open Reverse Proxy vulnerability.

Affected products

Sophos/Mobile Control Eas Proxy
cpe:2.3:a:sophos:mobile_control_eas_proxy:*:*:*:*:*:*:*:*
Range: <=3.5.0.3
Sophos/EAS Proxyllm-fuzzy
Range: <6.2.0

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/92351nvdThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/138210/Sophos-Mobile-Control-3.5.0.3-Open-Reverse-Proxy.htmlnvd
www.securityfocus.com/archive/1/539126/100/0/threadednvd
www.pallas.com/advisories/sophos_eas_open_reverse_proxy_vulnerabilitynvd

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000