Vulnerability Name:

CVE-2017-6323 (CCN-141742)

Assigned:2017-06-28
Published:2017-06-28
Updated:2018-05-23
Summary:The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.
CVSS v3 Severity:8.0 High (CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.0 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Adjacent
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
6.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L)
5.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Adjacent
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:5.2 Medium (CVSS v2 Vector: AV:A/AC:L/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Adjacent_Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.7 Medium (CCN CVSS v2 Vector: AV:A/AC:L/Au:S/C:C/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Adjacent_Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-611
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2017-6323

Source: BID
Type: Third Party Advisory, VDB Entry
98621

Source: CCN
Type: BID-98621
Symantec Management Console CVE-2017-6323 Multiple XML External Entity Injection Vulnerabilities

Source: XF
Type: UNKNOWN
symantec-management-cve20186323-info-disc(141742)

Source: CCN
Type: Symantec Security Advisory SYM17-005
Symantec Management Console XSS/XXE Issues

Source: CONFIRM
Type: Vendor Advisory
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170628_00

Vulnerable Configuration:Configuration 1:
  • cpe:/a:symantec:management_console:7.6:hf7:*:*:*:*:*:*
  • OR cpe:/a:symantec:management_console:8.0:hf6:*:*:*:*:*:*
  • OR cpe:/a:symantec:management_console:*:*:*:*:*:*:*:* (Version < 8.1)

    • * Denotes that component is vulnerable
    BACK
    symantec management console 7.6 hf7
    symantec management console 8.0 hf6
    symantec management console *