Vulnerability Name:

CVE-2007-0563 (CCN-31750)

Assigned:2007-01-24
Published:2007-01-24
Updated:2017-07-29
Summary:Multiple cross-site scripting (XSS) vulnerabilities in Symantec Web Security (SWS) before 3.0.1.85 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) error messages and (2) blocked page messages produced by SWS.
CVSS v3 Severity:4.8 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N)
3.5 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2007-0563

Source: OSVDB
Type: UNKNOWN
32960

Source: OSVDB
Type: UNKNOWN
32961

Source: CCN
Type: SA23896
Symantec Web Security Two Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
23896

Source: CCN
Type: SYM07-001
Symantec Web Security Multiple Vulnerability

Source: CONFIRM
Type: Patch, Vendor Advisory
http://securityresponse.symantec.com/avcenter/security/Content/2007.01.24c.html

Source: CCN
Type: SECTRACK ID: 1017558
Symantec Web Security Input Validation Hole Permits Cross-Site Scripting and Denial of Service Attacks

Source: SECTRACK
Type: UNKNOWN
1017558

Source: CCN
Type: OSVDB ID: 32960
Symantec Web Security (SWS) Error Page XSS

Source: CCN
Type: OSVDB ID: 32961
Symantec Web Security (SWS) Blocked Page XSS

Source: BID
Type: UNKNOWN
22184

Source: CCN
Type: BID-22184
Symantec Web Security Multiple Denial of Service And Cross-Site Scripting Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2007-0330

Source: XF
Type: UNKNOWN
symantec-html-xss(31750)

Source: XF
Type: UNKNOWN
symantec-html-xss(31750)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:symantec:web_security:3.0.1.72:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.59:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.60:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.61:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.62:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.63:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.67:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.68:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:symantec:web_security:3.01.62:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.0.1.72:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.68:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.67:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.63:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.61:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.60:*:*:*:*:*:*:*
  • OR cpe:/a:symantec:web_security:3.01.59:*:*:*:*:*:*:*
  • AND
  • cpe:/o:sun:solaris:8::sparc:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2003_server:*:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:-:sp4:*:*:server:*:*:*
  • OR cpe:/o:sun:solaris:10::sparc:*:*:*:*:*
  • OR cpe:/o:sun:solaris:9::sparc:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    symantec web security 3.0.1.72
    symantec web security 3.01.59
    symantec web security 3.01.60
    symantec web security 3.01.61
    symantec web security 3.01.62
    symantec web security 3.01.63
    symantec web security 3.01.67
    symantec web security 3.01.68
    symantec web security 3.01.62
    symantec web security 3.0.1.72
    symantec web security 3.01.68
    symantec web security 3.01.67
    symantec web security 3.01.63
    symantec web security 3.01.61
    symantec web security 3.01.60
    symantec web security 3.01.59
    sun solaris 8
    microsoft windows 2003 server *
    microsoft windows 2000 - sp4
    sun solaris 10
    sun solaris 9