CVE-2018-18370: XSS
First published: Thu Aug 29 2019(Updated: )
The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web listing of a remote FTP server. Exploiting the vulnerability requires the attacker to be able to upload crafted files to the remote FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2.
Credit: secure@symantec.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Broadcom Advanced Secure Gateway | >=6.7<6.7.4.2 | |
| Broadcom Advanced Secure Gateway | =6.6 | |
| Broadcom Symantec Proxysg | >=6.5<6.5.10.15 | |
| Broadcom Symantec Proxysg | >=6.7<6.7.4.2 | |
| Broadcom Symantec Proxysg | =6.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-18370?
CVE-2018-18370 is a vulnerability that allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web list.
What is the severity of CVE-2018-18370?
The severity of CVE-2018-18370 is medium with a CVSS score of 6.1.
How does CVE-2018-18370 affect Broadcom Advanced Secure Gateway?
CVE-2018-18370 affects Broadcom Advanced Secure Gateway versions 6.7 and below.
How does CVE-2018-18370 affect Broadcom Symantec ProxySG?
CVE-2018-18370 affects Broadcom Symantec ProxySG versions 6.7 and below.
How can I fix CVE-2018-18370?
To fix CVE-2018-18370, it is recommended to upgrade to a version higher than 6.7.4.2 for Broadcom Advanced Secure Gateway and Symantec ProxySG.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/author
- agent/weakness
- agent/softwarecombine
- agent/references
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/broadcom
- canonical/broadcom advanced secure gateway
- version/broadcom advanced secure gateway/6.7
- version/broadcom advanced secure gateway/6.6
- canonical/broadcom symantec proxysg
- version/broadcom symantec proxysg/6.5
- version/broadcom symantec proxysg/6.7
- version/broadcom symantec proxysg/6.6