CVE-2012-0297

HIGH

Description

The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.

References

http://www.securityfocus.com/bid/53444

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00

https://exchange.xforce.ibmcloud.com/vulnerabilities/75731

Details

Source: MITRE

Published: 2012-05-21

Updated: 2017-12-05

Type: CWE-264

Risk Information

CVSS v2.0

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 10

Severity: HIGH

Vulnerable Software

Configuration 1

cpe:2.3:a:symantec:web_gateway:5.0:*:*:*:*:*:*:*

cpe:2.3:a:symantec:web_gateway:5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:symantec:web_gateway:5.0.2:*:*:*:*:*:*:*

Tenable Plugins

View all (2 total)

ID	Name	Product	Family	Severity
59209	Symantec Web Gateway < 5.0.3 Multiple Vulnerabilities (SYM12-006) (version check)	Nessus	CGI abuses	critical
59208	Symantec Web Gateway ipchange.php Shell Command Injection (SYM12-006) (intrusive check)	Nessus	CGI abuses	critical