medium5.0Public exploit code
CVE-2012-4347
Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated users to read arbit…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Symantec Messaging Gateway 9.5.3-3 - Arbitrary File Download2012-12-03 · webapps · linux
Impact
Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated users to read arbitrary files via a .. (dot dot) in the (1) logFile parameter in a logs action to brightmail/export or (2) localBackupFileSelection parameter in an APPLIANCE restoreSource action to brightmail/admin/restore/download.do.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Symantec | Messaging Gateway | Versions 9.5, 9.5.1, 9.5.2, 9.5.3, 9.5.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/56789
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00
- http://www.securityfocus.com/bid/56789
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00