Sign-up

ID

VAR-201908-1590


CVE

CVE-2018-18371


TITLE

ASG and ProxySG Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2018-016057

DESCRIPTION

The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information disclosure vulnerability in the WebFTP mode allows a malicious user to obtain plaintext authentication credentials for a remote FTP server from the ASG/ProxySG's web listing of the FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2. ASG and ProxySG Contains an information disclosure vulnerability.Information may be obtained. Both Symantec Advanced Secure Gateway and Symantec ProxySG are security gateway devices of Symantec Corporation of the United States. This vulnerability stems from configuration errors in network systems or products during operation. An unauthorized attacker could exploit the vulnerability to obtain sensitive information of the affected components

Trust: 1.71

sources: NVD: CVE-2018-18371 // JVNDB: JVNDB-2018-016057 // VULHUB: VHN-128924

AFFECTED PRODUCTS

vendor:broadcommodel:symantec proxysgscope:gteversion:6.5

Trust: 1.0

vendor:broadcommodel:symantec proxysgscope:gteversion:6.7

Trust: 1.0

vendor:broadcommodel:symantec proxysgscope:ltversion:6.7.4.2

Trust: 1.0

vendor:broadcommodel:advanced secure gatewayscope:gteversion:6.7

Trust: 1.0

vendor:broadcommodel:advanced secure gatewayscope:eqversion:6.6

Trust: 1.0

vendor:broadcommodel:symantec proxysgscope:eqversion:6.6

Trust: 1.0

vendor:broadcommodel:advanced secure gatewayscope:ltversion:6.7.4.2

Trust: 1.0

vendor:broadcommodel:symantec proxysgscope:ltversion:6.5.10.15

Trust: 1.0

vendor:symantecmodel:advanced secure gatewayscope:eqversion:6.6

Trust: 0.8

vendor:symantecmodel:advanced secure gatewayscope:ltversion:6.7 thats all 6.7.4.2

Trust: 0.8

vendor:symantecmodel:proxysgscope:ltversion:6.5 thats all 6.5.10.15

Trust: 0.8

vendor:symantecmodel:proxysgscope:eqversion:6.6

Trust: 0.8

vendor:symantecmodel:proxysgscope:ltversion:6.7 thats all 6.7.4.2

Trust: 0.8

sources: JVNDB: JVNDB-2018-016057 // NVD: CVE-2018-18371

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-18371
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-18371
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201908-2133
value: MEDIUM

Trust: 0.6

VULHUB: VHN-128924
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-18371
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-128924
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-18371
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-128924 // JVNDB: JVNDB-2018-016057 // CNNVD: CNNVD-201908-2133 // NVD: CVE-2018-18371

PROBLEMTYPE DATA

problemtype:CWE-327

Trust: 1.1

problemtype:CWE-200

Trust: 0.9

sources: VULHUB: VHN-128924 // JVNDB: JVNDB-2018-016057 // NVD: CVE-2018-18371

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201908-2133

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201908-2133

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-016057

PATCH
title:SYMSA1472url:https://support.symantec.com/us/en/article.SYMSA1472.html
Trust: 0.8
title:Symantec Advanced Secure Gateway  and ProxySG Repair measures for information disclosure vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=97621
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-016057 // 
            
            
            
            CNNVD: CNNVD-201908-2133

EXTERNAL IDS
db:NVDid:CVE-2018-18371
Trust: 2.5
db:JVNDBid:JVNDB-2018-016057
Trust: 0.8
db:CNNVDid:CNNVD-201908-2133
Trust: 0.7
db:AUSCERTid:ESB-2019.3254
Trust: 0.6
db:VULHUBid:VHN-128924
Trust: 0.1
sources:
            
            
            VULHUB: VHN-128924 // 
            
            
            
            JVNDB: JVNDB-2018-016057 // 
            
            
            
            CNNVD: CNNVD-201908-2133 // 
            
            
            
            NVD: CVE-2018-18371

REFERENCES
url:https://support.symantec.com/us/en/article.symsa1472.html
Trust: 2.3
url:https://nvd.nist.gov/vuln/detail/cve-2018-18371
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18371
Trust: 0.8
url:https://vigilance.fr/vulnerability/proxysg-two-vulnerabilities-30176
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.3254/
Trust: 0.6
sources:
            
            
            VULHUB: VHN-128924 // 
            
            
            
            JVNDB: JVNDB-2018-016057 // 
            
            
            
            CNNVD: CNNVD-201908-2133 // 
            
            
            
            NVD: CVE-2018-18371

CREDITS
Muzamal Abadullah, Two Sigma Investments
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201908-2133

SOURCES
db:VULHUBid:VHN-128924
db:JVNDBid:JVNDB-2018-016057
db:CNNVDid:CNNVD-201908-2133
db:NVDid:CVE-2018-18371

LAST UPDATE DATE
2024-11-23T22:21:31.983000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-128924date:2021-06-24T00:00:00
db:JVNDBid:JVNDB-2018-016057date:2019-09-09T00:00:00
db:CNNVDid:CNNVD-201908-2133date:2020-10-28T00:00:00
db:NVDid:CVE-2018-18371date:2024-11-21T03:55:48.747

SOURCES RELEASE DATE
db:VULHUBid:VHN-128924date:2019-08-30T00:00:00
db:JVNDBid:JVNDB-2018-016057date:2019-09-09T00:00:00
db:CNNVDid:CNNVD-201908-2133date:2019-08-28T00:00:00
db:NVDid:CVE-2018-18371date:2019-08-30T09:15:16.660