Vulnerability identifier: #VU9013
Vulnerability risk: Low
CVSSv3.1: 6.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-284
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
ProxySG
Server applications /
IDS/IPS systems, Firewalls and proxy servers
Vendor: Blue Coat Systems
Description
The vulnerability allows a remote authenticated attacker to gain elevated privileges on the target system.
The weakness exists due to access control flaw in the web interface. A remote read-only administrative attacker can gain write privileges to modify the appliance settings and policy configuration and perform arbitrary management tasks via the management console.
Mitigation
The vulnerability is addressed in the following versions: 6.5.10.6, 6.6.5.8, 6.7.1.2.
Vulnerable software versions
ProxySG: 6.5 - 6.7
External links
http://www.symantec.com/security-center/network-protection-security-advisories/SA146
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.