CVE-2018-18370: XSS
The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web listing of a remote FTP server. Exploiting the vulnerability requires the attacker to be able to upload crafted files to the remote FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-18370?
CVE-2018-18370 is a vulnerability that allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web list.
What is the severity of CVE-2018-18370?
The severity of CVE-2018-18370 is medium with a CVSS score of 6.1.
How does CVE-2018-18370 affect Broadcom Advanced Secure Gateway?
CVE-2018-18370 affects Broadcom Advanced Secure Gateway versions 6.7 and below.
How does CVE-2018-18370 affect Broadcom Symantec ProxySG?
CVE-2018-18370 affects Broadcom Symantec ProxySG versions 6.7 and below.
How can I fix CVE-2018-18370?
To fix CVE-2018-18370, it is recommended to upgrade to a version higher than 6.7.4.2 for Broadcom Advanced Secure Gateway and Symantec ProxySG.