Reflected Cross-Site Scripting Vulnerability in Symantec Web Isolation

CVE-2018-12246

What is CVE-2018-12246?

The Symantec Web Isolation solution is vulnerable to a reflected cross-site scripting (XSS) flaw present in versions prior to 1.11.21. This vulnerability allows remote attackers to launch social engineering attacks on users protected by the Web Isolation platform. By crafting malicious URLs that appear legitimate, an attacker can execute unwanted scripts in the context of the victim's web browser. However, it is important to note that the attack does not affect the actual isolated version of the site managed by the WI Threat Isolation Engine.

References