File Inclusion Vulnerability in Symantec Messaging Gateway
CVE-2017-6325

6.6MEDIUM

Key Information:

Vendor
Symantec Corporation
Status
Messaging Gateway
Vendor
CVE Published:
26 June 2017

Summary

The Symantec Messaging Gateway is susceptible to a file inclusion vulnerability that arises from mishandling an attacker-controlled variable. When the application constructs a path to executable code, it inadvertently allows the attacker to dictate which file gets executed during runtime. This flaw can enable remote unauthorized access, potentially leading to the execution of malicious code on the web server hosting the application. Proper security measures are crucial to mitigate this risk and protect organizational resources.

Affected Version(s)

Messaging Gateway All versions prior to version 10.6.3

References

http://www.securitytracker.com/id/1038785
vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/98890
vdb-entryx_refsource_BID
https://www.symantec.com/security_response/securityupdate...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.