CVE-2016-10258: Malicious File Upload
First published: Wed Apr 11 2018(Updated: )
Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can upload arbitrary malicious files to the management console and trick another administrator user into downloading and executing malicious code.
Credit: secure@symantec.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Broadcom Symantec Advanced Secure Gateway | >=6.6<6.6.5.14 | |
| Broadcom Symantec Advanced Secure Gateway | >=6.7<6.7.3.1 | |
| Broadcom ProxySG | >=6.5<6.5.10.8 | |
| Broadcom ProxySG | >=6.6<6.6.5.14 | |
| Broadcom ProxySG | >=6.7<6.7.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-10258?
The severity of CVE-2016-10258 is medium.
Which software versions are affected by CVE-2016-10258?
CVE-2016-10258 affects Broadcom Advanced Secure Gateway versions 6.6 to 6.6.5.14, Broadcom Advanced Secure Gateway versions 6.7 to 6.7.3.1, Broadcom Symantec Proxysg versions 6.5 to 6.5.10.8, and Broadcom Symantec Proxysg versions 6.6 to 6.6.5.14.
What is the vulnerability in CVE-2016-10258?
CVE-2016-10258 is an unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles.
How can an attacker exploit CVE-2016-10258?
An attacker can exploit CVE-2016-10258 by uploading arbitrary malicious files to the management console and tricking another administrator user into downloading and executing the malicious code.
Are there any references for CVE-2016-10258?
Yes, you can find references for CVE-2016-10258 at the following URLs: [1](http://www.securityfocus.com/bid/103685), [2](http://www.securitytracker.com/id/1040757), [3](https://www.symantec.com/security-center/network-protection-security-advisories/SA162).
- agent/type
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/broadcom
- canonical/broadcom symantec advanced secure gateway
- version/broadcom symantec advanced secure gateway/6.6
- version/broadcom symantec advanced secure gateway/6.7
- canonical/broadcom proxysg
- version/broadcom proxysg/6.5
- version/broadcom proxysg/6.6
- version/broadcom proxysg/6.7