CVE-2018-12241

Name: CVE-2018-12241
Creator: NVD / NIST
Published: 2018-11-27T18:29:01.53+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.00%

Last modified Jun 17, 2026

CVE-2018-12241 is a vulnerability of currently unknown severity. The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web UI is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker with knowledge of the SA web UI hostname or IP address can craft a malicious URL for the SA web UI and target SA web UI users with phishing attacks or other social engineering techniques. EPSS estimates a 1.00% chance of exploitation in the next 30 days.

Description

The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web UI is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker with knowledge of the SA web UI hostname or IP address can craft a malicious URL for the SA web UI and target SA web UI users with phishing attacks or other social engineering techniques. A successful attack allows injecting malicious JavaScript code into the SA web UI client application.

Metrics

EPSS Probability

1.00%

58.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-79

Affected Software

Vendor	Product	Versions
Symantec	Security Analytics	>= 7.2.1, < 7.3.4

References

http://www.securityfocus.com/bid/105965Third Party Advisory, VDB Entry
https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1466.htmlVendor Advisory
http://www.securityfocus.com/bid/105965Third Party Advisory, VDB Entry
https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1466.htmlVendor Advisory

Timeline

Published: Nov 27, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-12241?

How severe is CVE-2018-12241?

Severity scoring for CVE-2018-12241 is pending analysis. The EPSS model estimates a 1.00% probability of exploitation in the next 30 days.

How do I fix CVE-2018-12241?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-12241?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST