Vulnerability CVE-2013-1617

Vulnerability Name:

CVE-2013-1617 (CCN-85985)

Assigned:

2013-07-25

Published:

2013-07-25

Updated:

2014-01-17

Summary:

Multiple SQL injection vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors.

CVSS v3 Severity:

7.6 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Adjacent Attack Complexity (AC): High Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.4 High (CVSS v2 Vector: AV:A/AC:M/Au:S/C:C/I:C/A:C)
6.4 Medium (Temporal CVSS v2 Vector: AV:A/AC:M/Au:S/C:C/I:C/A:C/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Adjacent_Network Access Complexity (AC): Medium Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.4 High (CCN CVSS v2 Vector: AV:A/AC:M/Au:S/C:C/I:C/A:C)
6.4 Medium (CCN Temporal CVSS v2 Vector: AV:A/AC:M/Au:S/C:C/I:C/A:C/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Adjacent_Network Access Complexity (AC): Medium Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete