// For flags

CVE-2018-12246

 

Severity Score

6.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious JavaScript code into the website's rendered copy running inside the end user's web browser. It does not allow injecting code into the real (isolated) copy of the website running on the WI Threat Isolation Engine.

Symantec Web Isolation (WI) en versiones 1.11 anteriores a la 1.11.21 es susceptible a una vulnerabilidad Cross-Site Scripting (XSS) reflejado. Un atacante remoto puede apuntar hacia usuarios finales protegidos por WI con ataques de ingeniería social mediante URL manipuladas para sitios web legítimos. Un ataque exitoso permite la inyección de código JavaScript en la copia renderizada del sitio web que se ejecuta en el navegador web del usuario final. No permite la inyección de código en la copia real (aislada) del sitio web que se ejecuta en WI Threat Isolation Engine.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-06-12 CVE Reserved
  • 2018-10-22 CVE Published
  • 2024-08-25 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Symantec
Search vendor "Symantec"
 Web Isolation
Search vendor "Symantec" for product "Web Isolation"
 >= 1.11 < 1.11.21
Search vendor "Symantec" for product "Web Isolation" and version " >= 1.11 < 1.11.21"
-
Affected