CVE-2018-12242 Auth bypass in Symantec Messaging Gateway
Attackers can bypass authentication to gain unauthorized access to the Symantec Messaging Gateway system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-12242?
CVE-2018-12242 is a critical authentication bypass vulnerability in Symantec Messaging Gateway, published on 19 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue that can allow attackers to potentially circumvent security mechanisms currently in place and gain access to the system or network.
Weakness: CWE-287
Which versions are affected by CVE-2018-12242?
It affects 1 product.
Products include Symantec Messaging Gateway.
How do I fix CVE-2018-12242?
No fix has been published for CVE-2018-12242 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-12242 being exploited?
There is no known exploitation of CVE-2018-12242 in the wild and no public exploit code.
Other vulnerabilities in Symantec Messaging Gateway
Sources
Also known as GHSA-76r2-2w4r-76jq.