CVE-2017-15532
Symantec Messaging Gateway Export Servlet snmpFileName Directory Traversal Information Disclosure Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack (also known as directory traversal). These types of attacks aim to access files and directories that are stored outside the web root folder. By manipulating variables, it may be possible to access arbitrary files and directories stored on the file system including application source code or configuration and critical system files.
En versiones anteriores a la 10.6.4, Symantec Messaging Gateway podría ser susceptible a un ataque de salto de ruta (también conocido como salto de directorio). Este tipo de ataque intenta acceder a archivos y directorios que están almacenados fuera de la carpeta web root. Al manipular variables, sería posible acceder a archivos y directorios arbitrarios almacenados en el sistema de archivos, incluyendo el código fuente de la aplicación o archivos críticos o de configuración del sistema.
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Symantec Messaging Gateway. Authentication is required to exploit this vulnerability.
The specific flaw exists within the export servlet. When parsing the snmpFileName parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose sensitive information under the context of the web service.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-10-17 CVE Reserved
- 2017-12-20 CVE Published
- 2024-09-16 CVE Updated
- 2024-11-22 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/102096 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Symantec Search vendor "Symantec" | Messaging Gateway Search vendor "Symantec" for product "Messaging Gateway" | < 10.6.4 Search vendor "Symantec" for product "Messaging Gateway" and version " < 10.6.4" | - |
Affected
|