CVE-2018-12246 Cross-site scripting in Symantec Web Isolation
Remote attackers can inject malicious JavaScript into end-user browsers via crafted URLs, bypassing web isolation protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-12246?
CVE-2018-12246 is a medium-severity cross-site scripting vulnerability in Symantec Web Isolation, published on 22 Oct 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious JavaScript code into the website's rendered copy running inside the end user's web browser. It does not allow injecting code into the real (isolated) copy of the website running on the WI Threat Isolation Engine.
Weakness: CWE-79
Which versions are affected by CVE-2018-12246?
It affects 1 product.
Products include Symantec Web Isolation.
How do I fix CVE-2018-12246?
No fix has been published for CVE-2018-12246 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-12246 being exploited?
There is no known exploitation of CVE-2018-12246 in the wild and no public exploit code.
Sources
Also known as GHSA-f249-2px5-3wq5.