SB2019120605 - Multiple vulnerabilities in Symantec Norton Password Manager
Published: December 6, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Information disclosure (CVE-ID: CVE-2019-19546)
The vulnerability allows a local attacker to gain access to potentially sensitive information.
The vulnerability exists due to improper access restrictions. A remote authenticated attacker on local network can gain unauthorized access to sensitive information on the system.
2) Overly permissive cross-domain whitelist (CVE-ID: CVE-2019-19545)
The vulnerability allows a local attacker to bypass the CORS protection mechanism.
The vulnerability exists due to incorrect processing of the "Origin" HTTP header that is supplied within HTTP request. A remote authenticated attacker on local network can supply arbitrary value via the "Origin" HTTP header, bypass implemented CORS protection mechanism and perform cross-site scripting attacks against the vulnerable application.
3) Overly permissive cross-domain whitelist (CVE-ID: CVE-2019-18381)
The vulnerability allows a local attacker to bypass the CORS protection mechanism.
The vulnerability exists due to incorrect processing of the "Origin" HTTP header that is supplied within HTTP request. A remote authenticated attacker on local network can supply arbitrary value via the "Origin" HTTP header, bypass implemented CORS protection mechanism and perform cross-site scripting attacks against the vulnerable application.
Remediation
Install update from vendor's website.