Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-6323

The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.

Published

2018-04-16T19:29:00.340

Last Modified

2024-11-21T03:29:33.740

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.0 (HIGH)

CVSSv2 Vector

AV:A/AC:L/Au:S/C:P/I:P/A:P

  • Access Vector: ADJACENT_NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

5.1

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-611
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application symantec management_console < 8.1 Yes
Application symantec management_console 7.6 Yes
Application symantec management_console 8.0 Yes
References