CVE-2014-1652

Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec Web Gateway (SWG) before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters.

CVSS v2.0 2.3 LOW

2.3^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 4.4 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.kb.cert.org/vuls/id/719172
http://www.securityfocus.com/bid/67755
http://www.securitytracker.com/id/1030443
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:symantec:web_gateway::::::::
	cpe:2.3:a:symantec:web_gateway:5.1:::::::*

History

No history.

Information

Published : 2014-06-18 19:55

Updated : 2024-02-28 12:20

NVD link : CVE-2014-1652

Mitre link : CVE-2014-1652

CVE.ORG link : CVE-2014-1652

JSON object : View

Products Affected

symantec

web_gateway

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2014-1652", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2014-06-18T19:55:04.623", "references": [{"url": "http://www.kb.cert.org/vuls/id/719172", "source": "secure@symantec.com"}, {"url": "http://www.securityfocus.com/bid/67755", "source": "secure@symantec.com"}, {"url": "http://www.securitytracker.com/id/1030443", "source": "secure@symantec.com"}, {"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00", "source": "secure@symantec.com"}, {"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00", "tags": ["Vendor Advisory"], "source": "secure@symantec.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec Web Gateway (SWG) before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de XSS en la consola de gesti\u00f3n en Symantec Web Gateway (SWG) anterior a 5.2 permiten a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de par\u00e1metros report manipulados."}], "lastModified": "2017-12-28T02:29:01.597", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symantec:web_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C46F03C-FE3F-4939-90FA-7D454686778F", "versionEndIncluding": "5.1.1"}, {"criteria": "cpe:2.3:a:symantec:web_gateway:5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1761BFB-3F97-43C5-BDCE-7D87F5E5D1F5"}], "operator": "OR"}]}], "sourceIdentifier": "secure@symantec.com"}