CVE-2018-18371
First published: Thu Aug 29 2019(Updated: )
The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information disclosure vulnerability in the WebFTP mode allows a malicious user to obtain plaintext authentication credentials for a remote FTP server from the ASG/ProxySG's web listing of the FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2.
Credit: secure@symantec.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Broadcom Advanced Secure Gateway | >=6.7<6.7.4.2 | |
| Broadcom Advanced Secure Gateway | =6.6 | |
| Broadcom Symantec Proxysg | >=6.5<6.5.10.15 | |
| Broadcom Symantec Proxysg | >=6.7<6.7.4.2 | |
| Broadcom Symantec Proxysg | =6.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-18371?
CVE-2018-18371 is an information disclosure vulnerability in the ASG/ProxySG FTP proxy WebFTP mode.
How does CVE-2018-18371 work?
CVE-2018-18371 allows a malicious user to obtain plaintext authentication credentials for a remote FTP server accessed via a ftp:// URL in a web browser.
What is the affected software?
The affected software includes Broadcom Advanced Secure Gateway versions 6.7 to 6.7.4.2, Broadcom Advanced Secure Gateway version 6.6, Broadcom Symantec Proxysg versions 6.5 to 6.5.10.15, and Broadcom Symantec Proxysg version 6.6.
What is the severity of CVE-2018-18371?
CVE-2018-18371 has a severity rating of medium.
How do I fix CVE-2018-18371?
To fix CVE-2018-18371, users should update to the latest version of the affected software.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/tags
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- vendor/broadcom
- canonical/broadcom advanced secure gateway
- version/broadcom advanced secure gateway/6.7
- version/broadcom advanced secure gateway/6.6
- canonical/broadcom symantec proxysg
- version/broadcom symantec proxysg/6.5
- version/broadcom symantec proxysg/6.7
- version/broadcom symantec proxysg/6.6