PT-2015-7038 · Symantec · Symantec Web Gateway

Jos Wetzels · Publicado 2015-09-16 · Atualizado 2016-12-22 · CVE-2015-5691

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 5.2.2 DB 5.0.0.1277

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in PHP scripts within the management console of Symantec Web Gateway appliances. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. An example of such an attack is demonstrated against the admin messages.php script.

Recommendations For Symantec Web Gateway versions prior to 5.2.2 DB 5.0.0.1277, update to version 5.2.2 DB 5.0.0.1277 or later to resolve the issue. As a temporary workaround, consider restricting access to the management console and PHP scripts to minimize the risk of exploitation. Avoid using the admin messages.php script until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-5691

ZDI-15-443

Produtos afetados

Symantec Web Gateway

Referências · 6

• http://securityfocus.com/bid/76728 · Nota
• http://securitytracker.com/id/1033625 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5691 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-15-443 · Nota
• https://zerodayinitiative.com/advisories/ZDI-15-443 · Nota de Segurança
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00 · Aviso do Fabricante