Symantec · Symantec Messaging Gateway

CVE-2017-6327

Symantec Messaging Gateway Remote Code Execution Vulnerability

Exploited in attacks High 8.8 Attack chance: 36%

What it is

The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to the system, the attacker may attempt to elevate their privileges.

CISA: Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 3, 2022

Added to the CISA list: November 3, 2021
Published: August 11, 2017
Severity: High 8.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 36% in the top 1.5% of all known vulnerabilities
Weakness: CWE-20
More details: NVD · CVE.org · CISA

All references (4)

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.