VULNERABILITY INTELLIGENCE

CVE-2018-12243

CVSS score8.8 HIGH

EPSS probability0.77%

CISA KEVNot currently listed

Published2018-09-19

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input containing a reference to an external entity is processed by a weakly configured XML parser. The attack uses file URI schemes or relative paths in the system identifier to access files that should not normally be accessible.

Weakness classification

CWE-611: Improper Restriction of XML External Entity Reference

Primary references

secure@symantec.com — Third Party Advisory, VDB Entry
secure@symantec.com — Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Vendor Advisory