CVE-2016-10257: XSS
The Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 (prior to 6.7.2.1), ProxySG 6.5 (prior to 6.5.10.6), ProxySG 6.6, and ProxySG 6.7 (prior to 6.7.2.1) management console is susceptible to a reflected XSS vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to inject arbitrary JavaScript code into the management console web client application. This is a separate vulnerability from CVE-2016-10256.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10257?
The severity of CVE-2016-10257 is medium.
What software is affected by CVE-2016-10257?
The Symantec Advanced Secure Gateway (ASG) versions 6.6 and 6.7 (prior to 6.7.2.1), ProxySG versions 6.5 (prior to 6.5.10.6), 6.6, and 6.7 (prior to 6.7.2.1) are affected.
What is the vulnerability in CVE-2016-10257?
CVE-2016-10257 is a reflected cross-site scripting (XSS) vulnerability in the management console of Symantec Advanced Secure Gateway and ProxySG.
How can a remote attacker exploit CVE-2016-10257?
A remote attacker can exploit CVE-2016-10257 by using a crafted management console URL in a phishing attack.
Are there any references related to CVE-2016-10257?
Yes, you can find more information about CVE-2016-10257 at the following references: [1] http://www.securityfocus.com/bid/102447, [2] http://www.securitytracker.com/id/1040138, [3] https://www.symantec.com/security-center/network-protection-security-advisories/SA155