CVE-2012-2976

The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary shell commands via crafted input to application scripts, related to an "injection" issue.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.kb.cert.org/vuls/id/108471
http://www.securityfocus.com/bid/54427
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:symantec:web_gateway:5.0:::::::*
	cpe:2.3:a:symantec:web_gateway:5.0.1:::::::*
	cpe:2.3:a:symantec:web_gateway:5.0.2:::::::*
	cpe:2.3:a:symantec:web_gateway:5.0.3:::::::*

History

No history.

Information

Published : 2012-07-23 17:55

Updated : 2023-12-10 11:16

NVD link : CVE-2012-2976

Mitre link : CVE-2012-2976

CVE.ORG link : CVE-2012-2976

JSON object : View

Products Affected

symantec

web_gateway

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2012-2976", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-07-23T17:55:03.657", "references": [{"url": "http://www.kb.cert.org/vuls/id/108471", "source": "cret@cert.org"}, {"url": "http://www.securityfocus.com/bid/54427", "source": "cret@cert.org"}, {"url": "http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00", "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary shell commands via crafted input to application scripts, related to an \"injection\" issue."}, {"lang": "es", "value": "La consola de gesti\u00f3n en Symantec Web Gateway v5.0.x anteriores a v5.0.3.18 permite a atacantes remotos ejecutar comandos del sistema a trav\u00e9s de una entrada manipulada sobre secuencias de comandos (script) de aplicaci\u00f3n, relacionado con una caracter\u00edstica de \"injection\".\r\n"}], "lastModified": "2017-12-22T02:29:10.700", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symantec:web_gateway:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F5B7857-75D5-4F77-81BF-7B55F743FD5F"}, {"criteria": "cpe:2.3:a:symantec:web_gateway:5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4525DE38-3B1F-490C-A772-BA0456FB6126"}, {"criteria": "cpe:2.3:a:symantec:web_gateway:5.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3956706B-44B9-40BC-9AAB-78A9583A2858"}, {"criteria": "cpe:2.3:a:symantec:web_gateway:5.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E5B2ABA-234A-43B1-8D91-33255F85AA26"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}