CVE-2018-12243
Last modified
CVE-2018-12243 is a vulnerability of currently unknown severity. The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input containing a reference to an external entity is processed by a weakly configured XML parser. The attack uses file URI schemes or relative paths in the system identifier to access files that should not normally be accessible.. EPSS estimates a 0.77% chance of exploitation in the next 30 days.
Description
The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input containing a reference to an external entity is processed by a weakly configured XML parser. The attack uses file URI schemes or relative paths in the system identifier to access files that should not normally be accessible.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Symantec | Messaging Gateway | < 10.6.6 |
References
- http://www.securityfocus.com/bid/105330Third Party Advisory, VDB Entry
- https://support.symantec.com/en_US/article.SYMSA1461.htmlMitigation, Vendor Advisory
- http://www.securityfocus.com/bid/105330Third Party Advisory, VDB Entry
- https://support.symantec.com/en_US/article.SYMSA1461.htmlMitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-12243?
How severe is CVE-2018-12243?
How do I fix CVE-2018-12243?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-12238Norton prior to 22.15; Symantec Endpoint Protection (SEP) pr…
- CVE-2018-12239Norton prior to 22.15; Symantec Endpoint Protection (SEP) pr…
- CVE-2018-1224Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2018-12240The Norton Identity Safe product prior to 5.3.0.976 may be s…5.9
- CVE-2018-12241The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web …
- CVE-2018-12242The Symantec Messaging Gateway product prior to 10.6.6 may b…
- CVE-2018-12244SEP (Mac client) prior to and including 12.1 RU6 MP9 and pri…
- CVE-2018-12245Symantec Endpoint Protection prior to 14.2 MP1 may be suscep…
- CVE-2018-12246Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is suscept…
- CVE-2018-12247An issue was discovered in mruby 1.4.1. There is a NULL poin…
- CVE-2018-12248An issue was discovered in mruby 1.4.1. There is a heap-base…
- CVE-2018-12249An issue was discovered in mruby 1.4.1. There is a NULL poin…7.5
Are you affected by CVE-2018-12243?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST