PT-2018-1937 · Symantec · Symantec Web Isolation

Publicado 2018-10-16 · Atualizado 2018-12-06 · CVE-2018-12246

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Symantec Web Isolation (WI) versions 1.11 through 1.11.20

Description The issue allows a remote attacker to target end users with social engineering attacks using crafted URLs for legitimate websites, potentially injecting malicious JavaScript code into the website's rendered copy running inside the end user's web browser. This does not affect the real (isolated) copy of the website running on the WI Threat Isolation Engine. The vulnerability exists due to inadequate protection of the web page structure, which can be exploited by a remote attacker to inject arbitrary code into a loaded web page using a specially formed URI address.

Recommendations For Symantec Web Isolation (WI) versions 1.11 through 1.11.20, update to version 1.11.21 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2018-01544

CVE-2018-12246

Produtos afetados

Symantec Web Isolation

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-12246 · Nota de Segurança
• https://securityfocus.com/bid/105581/info · Nota
• https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1464.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-01544 · Nota de Segurança
• https://vuldb.com/?id.125837 · Nota
• https://osv.dev/vulnerability/CVE-2018-12246 · Aviso do Fabricante
• http://securityfocus.com/bid/105581 · Nota