CVE-2016-10257: XSS
First published: Wed Jan 10 2018(Updated: )
The Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 (prior to 6.7.2.1), ProxySG 6.5 (prior to 6.5.10.6), ProxySG 6.6, and ProxySG 6.7 (prior to 6.7.2.1) management console is susceptible to a reflected XSS vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to inject arbitrary JavaScript code into the management console web client application. This is a separate vulnerability from CVE-2016-10256.
Credit: secure@symantec.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Broadcom Advanced Secure Gateway | >=6.7<6.7.2.1 | |
| Broadcom Advanced Secure Gateway | =6.6 | |
| Broadcom Symantec Proxysg | >=6.5<6.5.10.6 | |
| Broadcom Symantec Proxysg | >=6.7<6.7.2.1 | |
| Broadcom Symantec Proxysg | =6.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-10257?
The severity of CVE-2016-10257 is medium.
What software is affected by CVE-2016-10257?
The Symantec Advanced Secure Gateway (ASG) versions 6.6 and 6.7 (prior to 6.7.2.1), ProxySG versions 6.5 (prior to 6.5.10.6), 6.6, and 6.7 (prior to 6.7.2.1) are affected.
What is the vulnerability in CVE-2016-10257?
CVE-2016-10257 is a reflected cross-site scripting (XSS) vulnerability in the management console of Symantec Advanced Secure Gateway and ProxySG.
How can a remote attacker exploit CVE-2016-10257?
A remote attacker can exploit CVE-2016-10257 by using a crafted management console URL in a phishing attack.
Are there any references related to CVE-2016-10257?
Yes, you can find more information about CVE-2016-10257 at the following references: [1] http://www.securityfocus.com/bid/102447, [2] http://www.securitytracker.com/id/1040138, [3] https://www.symantec.com/security-center/network-protection-security-advisories/SA155
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/weakness
- agent/event
- agent/first-publish-date
- agent/tags
- agent/description
- vendor/broadcom
- canonical/broadcom advanced secure gateway
- version/broadcom advanced secure gateway/6.7
- version/broadcom advanced secure gateway/6.6
- canonical/broadcom symantec proxysg
- version/broadcom symantec proxysg/6.5
- version/broadcom symantec proxysg/6.7
- version/broadcom symantec proxysg/6.6