PT-2018-4648 · Symantec · Symantec Proxysg

Published 2018-01-10 · Updated 2021-07-08 · CVE-2016-10256

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Symantec ProxySG versions prior to 6.5.10.6 Symantec ProxySG version 6.6 Symantec ProxySG versions prior to 6.7.2.1

Description The management console of Symantec ProxySG is susceptible to a reflected XSS issue. A remote attacker can use a crafted management console URL in a phishing attack to inject arbitrary JavaScript code into the management console web client application.

Recommendations For Symantec ProxySG versions prior to 6.5.10.6, update to version 6.5.10.6 or later. For Symantec ProxySG version 6.6, update to a version that is not affected, such as 6.7.2.1 or later. For Symantec ProxySG versions prior to 6.7.2.1, update to version 6.7.2.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-10256

Affected Products

Symantec Proxysg

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-10256 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10256 · Vendor Advisory
• https://symantec.com/security-center/network-protection-security-advisories/SA155 · Vendor Advisory
• http://securityfocus.com/bid/102451 · Note
• http://securitytracker.com/id/1040138 · Note
• https://t.me/cvenotify/17263 · Telegram Post