CVE-2018-12243 XML external entity in Symantec Messaging Gateway

What is CVE-2018-12243?

CVE-2018-12243 is a high-severity vulnerability in Symantec Messaging Gateway, published on 19 Sep 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input containing a reference to an external entity is processed by a weakly configured XML parser. The attack uses file URI schemes or relative paths in the system identifier to access files that should not normally be accessible.

Weakness: CWE-611

Which versions are affected by CVE-2018-12243?

It affects 1 product.

Products include Symantec Messaging Gateway.

How do I fix CVE-2018-12243?

No fix has been published for CVE-2018-12243 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-12243 being exploited?

There is no known exploitation of CVE-2018-12243 in the wild and no public exploit code.

Other vulnerabilities in Symantec Messaging Gateway

• CVE-2017-6326 Code injection in Messaging Gateway Critical 10.0
• CVE-2018-12242 Auth bypass in Symantec Messaging Gateway Critical 9.8
• CVE-2016-2204 Command injection in n/a High 8.2
• CVE-2012-3579 Hardcoded credentials in n/a High 7.9
• CVE-2016-2203 Information disclosure in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-82xf-qv3c-486v.