CVE-2017-6327

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 35,9%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada symantec message gateway. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to the system, the attacker may attempt to elevate their privileges.

Rincian

Terbit di NVD

11 Agustus 2017

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

35,9% peluang dieksploitasi; lebih tinggi dari 98,4% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Symantec Messaging Gateway Remote Code Execution Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advi... advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6327 pemerintah AS
• http://seclists.org/fulldisclosure/2017/Aug/28 mailing list · advisory pihak ketiga
• http://www.securityfocus.com/bid/100135 broken link · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/42519/ advisory pihak ketiga · vdb entry