Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to obtain potentially sensitive information about component versions vi

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• symantec messaging gatewayup to 9.5.4 inclusive
• symantec messaging gateway9.5
• symantec messaging gateway9.5.1
• symantec messaging gateway9.5.2
• symantec messaging gateway9.5.3

Other highest-scoring records for the same primary product.

• CVE-2017-6326The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain
  62This week
• CVE-2012-3579Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers t
  43Plan
• CVE-2016-5312Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to
  42Plan
• CVE-2018-12242The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue that
  40Plan
• CVE-2012-4347Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated
  38Monitor
• CVE-2018-12243The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue w
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.