Sign-up

ID

VAR-202012-0098


CVE

CVE-2020-12594


TITLE

SMG  Vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-014351

DESCRIPTION

A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SMG appliance. This affects SMG prior to 10.7.4. SMG Contains an unspecified vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Symantec Messaging Gateway is a set of spam filters of Symantec Corporation of the United States. The product includes features such as antispam, antivirus, advanced content filtering, and data loss prevention. Symantec Messaging Gateway before version 10.7.4 has an authorization problem vulnerability. This vulnerability is caused by improper privilege control required for system upgrades. Attackers can complete the control of the device by upgrading the privileges of the SMG device

Trust: 1.71

sources: NVD: CVE-2020-12594 // JVNDB: JVNDB-2020-014351 // VULHUB: VHN-165288

AFFECTED PRODUCTS

vendor:broadcommodel:symantec messaging gatewayscope:ltversion:10.7.4

Trust: 1.0

vendor:broadcommodel:symantec messaging gatewayscope:eqversion:10.7.4

Trust: 0.8

vendor:broadcommodel:symantec messaging gatewayscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-014351 // NVD: CVE-2020-12594

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-12594
value: HIGH

Trust: 1.0

NVD: CVE-2020-12594
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202012-844
value: HIGH

Trust: 0.6

VULHUB: VHN-165288
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-12594
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-165288
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-12594
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2020-12594
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-165288 // JVNDB: JVNDB-2020-014351 // CNNVD: CNNVD-202012-844 // NVD: CVE-2020-12594

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:Lack of information (CWE-noinfo) [NVD Evaluation ]

Trust: 0.8

problemtype:CWE-269

Trust: 0.1

sources: VULHUB: VHN-165288 // JVNDB: JVNDB-2020-014351 // NVD: CVE-2020-12594

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202012-844

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202012-844

PATCH

title:SYMSA16609url:https://support.broadcom.com/security-advisory/content/security-advisories/Privilege-Escalation-and-Information-Disclosure-Vulnerabilities-in-SMG/SYMSA16609

Trust: 0.8

title:Symantec Messaging Gateway Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=137278

Trust: 0.6

sources: JVNDB: JVNDB-2020-014351 // CNNVD: CNNVD-202012-844

EXTERNAL IDS

db:NVDid:CVE-2020-12594

Trust: 2.5

db:JVNDBid:JVNDB-2020-014351

Trust: 0.8

db:CNNVDid:CNNVD-202012-844

Trust: 0.7

db:VULHUBid:VHN-165288

Trust: 0.1

sources: VULHUB: VHN-165288 // JVNDB: JVNDB-2020-014351 // CNNVD: CNNVD-202012-844 // NVD: CVE-2020-12594

REFERENCES

url:https://support.broadcom.com/security-advisory/content/security-advisories/privilege-escalation-and-information-disclosure-vulnerabilities-in-smg/symsa16609

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2020-12594

Trust: 1.4

sources: VULHUB: VHN-165288 // JVNDB: JVNDB-2020-014351 // CNNVD: CNNVD-202012-844 // NVD: CVE-2020-12594

SOURCES

db:VULHUBid:VHN-165288
db:JVNDBid:JVNDB-2020-014351
db:CNNVDid:CNNVD-202012-844
db:NVDid:CVE-2020-12594

LAST UPDATE DATE

2024-11-23T21:35:02.851000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-165288date:2021-07-21T00:00:00
db:JVNDBid:JVNDB-2020-014351date:2021-08-13T09:04:00
db:CNNVDid:CNNVD-202012-844date:2020-12-15T00:00:00
db:NVDid:CVE-2020-12594date:2024-11-21T04:59:53.917

SOURCES RELEASE DATE

db:VULHUBid:VHN-165288date:2020-12-10T00:00:00
db:JVNDBid:JVNDB-2020-014351date:2021-08-13T00:00:00
db:CNNVDid:CNNVD-202012-844date:2020-12-10T00:00:00
db:NVDid:CVE-2020-12594date:2020-12-10T06:15:12.060