vulnwire
7.8high

CVE-2016-9100

Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 37%
Public exploits
0
none known

Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to 6.6.5.13, and ProxySG 6.7 prior to 6.7.3.1 are susceptible to an information disclosure vulnerability. An attacker with local access to the client host of an authenticated administrator user can, under certain circumstances, obtain sensitive authentication credential information.

Exploit prediction (EPSS)

0.43% probability of exploitation in the next 30 days, higher than 37% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.02.1AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Symantec Corporation ASG
  • Symantec Corporation ProxySG

Classification

Weakness
  • CWE-255 Credentials Management Errors

References

  • securitytracker.com /id/1040138 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • symantec.com /security-center/network-protection-security-advisories/SA155 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/102454 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.