| Vulnerability Name: | CVE-2013-1616 (CCN-85984) | ||||||||
| Assigned: | 2013-07-25 | ||||||||
| Published: | 2013-07-25 | ||||||||
| Updated: | 2014-01-17 | ||||||||
| Summary: | The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script. | ||||||||
| CVSS v3 Severity: | 9.6 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 8.3 High (CVSS v2 Vector: AV:A/AC:L/Au:N/C:C/I:C/A:C) 6.2 Medium (Temporal CVSS v2 Vector: AV:A/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
6.2 Medium (CCN Temporal CVSS v2 Vector: AV:A/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-78 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2013-1616 Source: MISC Type: UNKNOWN http://packetstormsecurity.com/files/122556/Symantec-Web-Gateway-XSS-CSRF-SQL-Injection-Command-Injection.html Source: CCN Type: SA54294 Symantec Web Gateway Multiple Vulnerabilities Source: BID Type: UNKNOWN 61106 Source: CCN Type: BID-61106 Symantec Web Gateway CVE-2013-1616 Remote Command Injection Vulnerability Source: CCN Type: SYM13-008 Symantec Web Gateway Security Issues Source: CONFIRM Type: Vendor Advisory http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130725_00 Source: XF Type: UNKNOWN symantec-web-cve20131616-command-exec(85984) Source: CCN Type: Packet Storm Security [7-26-2013] Symantec Web Gateway XSS / CSRF / SQL Injection / Command Injection Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [07-26-2013] Source: MISC Type: UNKNOWN https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130726-0_Symantec_Web_Gateway_Multiple_Vulnerabilities_v10.txt | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| BACK | |||||||||