CVE-2014-7285: Command Injection
Published Dec 17, 2014
·Updated
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.
Affected Software
1 affected component
Symantec Web Gateway<=5.2.1
Event History
Dec 17, 2014
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-7285?
CVE-2014-7285 has been assigned a CVSS score indicating a high severity level due to its potential for remote command execution.
2
How do I fix CVE-2014-7285?
To fix CVE-2014-7285, you should upgrade the Symantec Web Gateway appliance to version 5.2.2 or later.
3
Who is affected by CVE-2014-7285?
CVE-2014-7285 affects users of the Symantec Web Gateway appliance versions prior to 5.2.2.
4
What kind of attack can exploit CVE-2014-7285?
CVE-2014-7285 can be exploited by remote authenticated users to execute arbitrary operating system commands.
5
What PHP scripts are involved in CVE-2014-7285?
CVE-2014-7285 involves unspecified PHP scripts in the management console of the Symantec Web Gateway.