CVE-2012-0308
medium
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8
Description
Cross-site request forgery (CSRF) vulnerability in Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to hijack the authentication of administrators.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: cve@mitre.org — http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| symantec | messaging_gateway | {"endIncluding":"9.5.4"} | |
| symantec | messaging_gateway | 9.5 | |
| symantec | messaging_gateway | 9.5.1 | |
| symantec | messaging_gateway | 9.5.2 | |
| symantec | messaging_gateway | 9.5.3 | |
| symantec | messaging_gateway | 10.0 | |
References
- http://www.securityfocus.com/bid/55137
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00
- http://www.securityfocus.com/bid/55137
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00
CWEs
CWE-352
Verify integrity in audit chain (admin only). AS-IS.