Symantec Web Gateway < 5.1.1 Multiple Vulnerabilities (SYM13-008)

2013-08-0600:00:00

Tenable

www.tenable.com

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.034

Percentile

91.6%

JSON

The remote web server is hosting Symantec Web Gateway application. Versions of Symantec Web Gateway 5.1.x, are potentially affected by the following vulnerabilities :

Multiple cross-site scripting vulnerabilities exist.(CVE-2013-4670)
It is possible to inject arbitrary operating system commands via the ‘nameConfig.php’ and ‘networkConfig.php’ scripts. (CVE-2013-1616)
A misconfiguration in the ‘/etc/sudoers’ file allows the user’s ‘apache’ and ‘admin’ to run several commands with root privileges. (CVE-2013-4672)
Multiple SQL injection vulnerabilities exist.(CVE-2013-1617)
A cross-site request forgery vulnerability exists in the’ ldapConfig.php’ script. CVE-2013-4671).