PT-2018-1937 · Symantec · Symantec Web Isolation

Published 2018-10-16 · Updated 2018-12-06 · CVE-2018-12246

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Symantec Web Isolation (WI) versions 1.11 through 1.11.20

Description The issue allows a remote attacker to target end users with social engineering attacks using crafted URLs for legitimate websites, potentially injecting malicious JavaScript code into the website's rendered copy running inside the end user's web browser. This does not affect the real (isolated) copy of the website running on the WI Threat Isolation Engine. The vulnerability exists due to inadequate protection of the web page structure, which can be exploited by a remote attacker to inject arbitrary code into a loaded web page using a specially formed URI address.

Recommendations For Symantec Web Isolation (WI) versions 1.11 through 1.11.20, update to version 1.11.21 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2018-01544

CVE-2018-12246

Affected Products

Symantec Web Isolation

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-12246 · Security Note
• https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1464.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01544 · Security Note
• https://osv.dev/vulnerability/CVE-2018-12246 · Vendor Advisory
• https://securityfocus.com/bid/105581/info · Note
• https://vuldb.com/?id.125837 · Note
• http://securityfocus.com/bid/105581 · Note