XXE in Symantec Management Console
CVE-2017-6323
The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.
Vulnerability class: XXE (XML External Entity)
EPSS: 0.005 (41.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Symantec Management_console — versions 7.6, 8.0
- Symantec Corporation Itms — versions Prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6 & ITMS 7.6_POST_HF7
Weakness classification (CWE)
References
- secure@symantec.com (x_refsource_CONFIRM, Vendor Advisory)
- secure@symantec.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2017-6323?
- CVE-2017-6323 is a high-severity vulnerability in Symantec Management Console, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.0/10. Published 2018-04-16.
- How severe is CVE-2017-6323?
- High severity. CVSS v3 base score is 8.0 out of 10.