Details of VAR-201404-0405

ID

VAR-201404-0405

CVE

CVE-2014-1648

TITLE

Symantec Messaging Gateway Management console cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-002227

DESCRIPTION

Cross-site scripting (XSS) vulnerability in brightmail/setting/compliance/DlpConnectFlow$view.flo in the management console in Symantec Messaging Gateway 10.x before 10.5.2 allows remote attackers to inject arbitrary web script or HTML via the displayTab parameter. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials, hijack the browser session, and launch other attacks. Symantec Messaging Gateway 10.0.0 through versions prior to 10.5.2 are vulnerable. Symantec Messaging Gateway is a spam filter that integrates anti-spam, anti-virus, advanced content filtering and data leakage prevention technologies from Symantec

Trust: 1.98

sources: NVD: CVE-2014-1648 // JVNDB: JVNDB-2014-002227 // BID: 66966 // VULHUB: VHN-69587

AFFECTED PRODUCTS

vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.0	Trust: 1.6
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.0.2	Trust: 1.6
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.0.3	Trust: 1.6
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.5.1	Trust: 1.6
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.0.1	Trust: 1.6
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.5.0	Trust: 1.6
vendor:	symantec	model:	messaging gateway	scope:	eq	version:	10.5.2	Trust: 0.8
vendor:	symantec	model:	messaging gateway	scope:	lt	version:	10.x	Trust: 0.8

sources: JVNDB: JVNDB-2014-002227 // CNNVD: CNNVD-201404-473 // NVD: CVE-2014-1648

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2014-1648
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2014-1648
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201404-473
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-69587
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2014-1648
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-69587
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-69587 // JVNDB: JVNDB-2014-002227 // CNNVD: CNNVD-201404-473 // NVD: CVE-2014-1648

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-69587 // JVNDB: JVNDB-2014-002227 // NVD: CVE-2014-1648

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201404-473

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201404-473

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-002227

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-69587

PATCH

title:	SYM14-006	url:	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140422_00	Trust: 0.8
title:	SYM14-006	url:	http://www.symantec.com/ja/jp/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140422_00	Trust: 0.8

sources: JVNDB: JVNDB-2014-002227

EXTERNAL IDS

db:	NVD	id:	CVE-2014-1648	Trust: 2.8
db:	BID	id:	66966	Trust: 2.0
db:	SECTRACK	id:	1030136	Trust: 1.1
db:	JVNDB	id:	JVNDB-2014-002227	Trust: 0.8
db:	CNNVD	id:	CNNVD-201404-473	Trust: 0.7
db:	SECUNIA	id:	58047	Trust: 0.6
db:	FULLDISC	id:	20140422 (CVE-2014-1648) SYMANTEC MESSAGING GATEWAY MANAGEMENT CONSOLE CROSS SITE SCRIPTING VULNERABILITY	Trust: 0.6
db:	PACKETSTORM	id:	126264	Trust: 0.1
db:	VULHUB	id:	VHN-69587	Trust: 0.1

sources: VULHUB: VHN-69587 // BID: 66966 // JVNDB: JVNDB-2014-002227 // CNNVD: CNNVD-201404-473 // NVD: CVE-2014-1648

REFERENCES

url:	http://www.securityfocus.com/bid/66966	Trust: 1.7
url:	http://seclists.org/fulldisclosure/2014/apr/256	Trust: 1.7
url:	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140422_00	Trust: 1.6
url:	http://www.securitytracker.com/id/1030136	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-1648	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-1648	Trust: 0.8
url:	http://secunia.com/advisories/58047	Trust: 0.6
url:	http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140422_00	Trust: 0.1

sources: VULHUB: VHN-69587 // JVNDB: JVNDB-2014-002227 // CNNVD: CNNVD-201404-473 // NVD: CVE-2014-1648

CREDITS

William Costa

Trust: 0.3

sources: BID: 66966

SOURCES

db:	VULHUB	id:	VHN-69587
db:	BID	id:	66966
db:	JVNDB	id:	JVNDB-2014-002227
db:	CNNVD	id:	CNNVD-201404-473
db:	NVD	id:	CVE-2014-1648

LAST UPDATE DATE

2024-11-23T22:27:20.619000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-69587	date:	2015-08-06T00:00:00
db:	BID	id:	66966	date:	2014-04-22T00:00:00
db:	JVNDB	id:	JVNDB-2014-002227	date:	2014-04-25T00:00:00
db:	CNNVD	id:	CNNVD-201404-473	date:	2014-04-25T00:00:00
db:	NVD	id:	CVE-2014-1648	date:	2024-11-21T02:04:46.580

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-69587	date:	2014-04-23T00:00:00
db:	BID	id:	66966	date:	2014-04-22T00:00:00
db:	JVNDB	id:	JVNDB-2014-002227	date:	2014-04-25T00:00:00
db:	CNNVD	id:	CNNVD-201404-473	date:	2014-04-25T00:00:00
db:	NVD	id:	CVE-2014-1648	date:	2014-04-23T11:52:59.587