Server-Side Request Forgery Vulnerability in Symantec Messaging Gateway
CVE-2019-18379

7.3HIGH

Key Information:

Vendor
Symantec
Status
Symantec Messaging Gateway
Vendor
CVE Published:
11 December 2019

Summary

Symantec Messaging Gateway, before version 10.7.3, features a security flaw where an attacker can conduct server-side request forgery (SSRF). This vulnerability allows unauthorized crafting of requests from the backend server, potentially exposing internal services and resources that should be safeguarded from external access, especially those reachable via the loopback interface. Proper security measures should be implemented to mitigate risks associated with this vulnerability and ensure comprehensive protection of systems.

Affected Version(s)

Symantec Messaging Gateway prior to 10.7.3

References

https://support.symantec.com/us/en/article.SYMSA1501.html
x_refsource_MISC

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.