CVE-2017-6325: symantec corporation messaging gateway Code Injection

Vulnerability summary

CVE-2017-6325 is a medium (CVSS 6.6) Code Injection vulnerability in symantec corporation messaging gateway. EPSS estimates a 2.50% chance of exploitation in the next 30 days, higher than 84.4% of scored vulnerabilities.

Timeline

1. 26-06-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

The Symantec Messaging Gateway can encounter a file inclusion vulnerability, which is a type of vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. This file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.