Symantec Brightmail Gateway Management Console Multiple HTML Injection Vulnerabilities

Bugtraq ID:	59700
Class:	Input Validation Error
CVE:	CVE-2013-1611
Remote:	Yes
Local:	No
Published:	May 08 2013 12:00AM
Updated:	May 09 2013 09:52AM
Credit:	Puneeth Kumar R.
Vulnerable:	Symantec Brightmail Gateway 9.5.1 Symantec Brightmail Gateway 9.5
Not Vulnerable:

Symantec Brightmail Gateway Management Console Multiple HTML Injection Vulnerabilities

Symantec Brightmail Gateway is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Symantec Brightmail Gateway 9.5.x are vulnerable.

Symantec Brightmail Gateway Management Console Multiple HTML Injection Vulnerabilities

An attacker can exploit these issues through a browser.

Symantec Brightmail Gateway Management Console Multiple HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Symantec Brightmail Gateway Management Console Multiple HTML Injection Vulnerabilities

References:

• Symantec Homepage (Symantec)