Symantec Messaging Gateway CVE-2017-6328 Cross Site Request Forgery Vulnerability

Bugtraq ID:	100136
Class:	Design Error
CVE:	CVE-2017-6328
Remote:	Yes
Local:	No
Published:	Aug 10 2017 12:00AM
Updated:	Aug 10 2017 12:00AM
Credit:	Mishra Dhiraj.
Vulnerable:	Symantec Messaging Gateway 10.6.3 Symantec Messaging Gateway 10.5.2 Symantec Messaging Gateway 10.5.1 Symantec Messaging Gateway 10.5 Symantec Messaging Gateway 10.0.1 Symantec Messaging Gateway 9.5.1 Symantec Messaging Gateway 9.5.3-3 Symantec Messaging Gateway 9.5 Symantec Messaging Gateway 10.6.3-266 Symantec Messaging Gateway 10.6.2 Symantec Messaging Gateway 10.6.1-3 Symantec Messaging Gateway 10.6.1 Symantec Messaging Gateway 10.6.0-7 Symantec Messaging Gateway 10.6.0-3 Symantec Messaging Gateway 10.6 Symantec Messaging Gateway 10.1 Symantec Messaging Gateway 10.0.2 Symantec Messaging Gateway 10.0
Not Vulnerable:	Symantec Messaging Gateway 10.6.3-267

Symantec Messaging Gateway CVE-2017-6328 Cross Site Request Forgery Vulnerability

Symantec Messaging Gateway is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Versions prior to Symantec Messaging Gateway 10.6.3-267 are vulnerable.

Symantec Messaging Gateway CVE-2017-6328 Cross Site Request Forgery Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Symantec Messaging Gateway CVE-2017-6328 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Symantec Messaging Gateway CVE-2017-6328 Cross Site Request Forgery Vulnerability

References:

• Symantec Homepage (Symantec)
  
• SYM17-006: Security Advisories Relating to Symantec Products - Symantec Messagin (Symantec)