CVE-2014-7285
medium · 6.5The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.
6.5
CVSS
50.3%
EPSS (exploit prob.)
99th
EPSS percentile
2014-12-17
Published
AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-77
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| symantec | web_gateway | <= 5.2.1 |
Check a specific version with /api/v1/cve/match.
References
- http://karmainsecurity.com/KIS-2014-19
- http://osvdb.org/show/osvdb/116009
- http://packetstormsecurity.com/files/130612/Symantec-Web-Gateway-5-restore.php-Command-Injection.html
- http://www.exploit-db.com/exploits/36263
- http://www.securityfocus.com/bid/71620
- http://www.securitytracker.com/id/1031386
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141216_00
- http://karmainsecurity.com/KIS-2014-19
- http://osvdb.org/show/osvdb/116009
- http://packetstormsecurity.com/files/130612/Symantec-Web-Gateway-5-restore.php-Command-Injection.html
- http://www.exploit-db.com/exploits/36263
- http://www.securityfocus.com/bid/71620
- http://www.securitytracker.com/id/1031386
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141216_00
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2014-7285