CVE-2015-5690

The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a "redirect."

CVSS v2.0 8.5 HIGH

8.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability : 6.8 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/76725
http://www.securitytracker.com/id/1033625
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00	Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-15-444/
http://www.securityfocus.com/bid/76725
http://www.securitytracker.com/id/1033625
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00	Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-15-444/

Configurations

Configuration 1 (hide)

cpe:2.3:a:symantec:web_gateway:*:*:*:*:*:*:*:*

History

21 Nov 2024, 02:33

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/76725 -~~	() http://www.securityfocus.com/bid/76725 -
References	~~() http://www.securitytracker.com/id/1033625 -~~	() http://www.securitytracker.com/id/1033625 -
References	~~() http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00 - Vendor Advisory~~	() http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00 - Vendor Advisory
References	~~() http://www.zerodayinitiative.com/advisories/ZDI-15-444/ -~~	() http://www.zerodayinitiative.com/advisories/ZDI-15-444/ -

Information

Published : 2015-09-20 20:59

Updated : 2024-11-21 02:33

NVD link : CVE-2015-5690

Mitre link : CVE-2015-5690

CVE.ORG link : CVE-2015-5690

JSON object : View

Products Affected

symantec

web_gateway

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2015-5690", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-09-20T20:59:05.257", "references": [{"url": "http://www.securityfocus.com/bid/76725", "source": "secure@symantec.com"}, {"url": "http://www.securitytracker.com/id/1033625", "source": "secure@symantec.com"}, {"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00", "tags": ["Vendor Advisory"], "source": "secure@symantec.com"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-15-444/", "source": "secure@symantec.com"}, {"url": "http://www.securityfocus.com/bid/76725", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1033625", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.zerodayinitiative.com/advisories/ZDI-15-444/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a \"redirect.\""}, {"lang": "es", "value": "Vulnerabilidad en la consola de gesti\u00f3n en Symantec Web Gateway (SWG) en dispositivos con software en versiones anteriores a 5.2.2 DB 5.0.0.1277, permite a usuarios remotos autenticados eludir las restricciones destinadas al acceso y ejecutar comandos arbitarios mediante el aprovechamiento de un 'redirect'."}], "lastModified": "2024-11-21T02:33:38.937", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symantec:web_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47C107AC-7C64-4630-A7C5-2A3275853166", "versionEndIncluding": "5.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "secure@symantec.com"}