Vulnerabilities > CVE-2017-6323 - XXE vulnerability in Symantec Management Console 7.6/8.0
Attack vector
ADJACENT_NETWORK Attack complexity
LOW Privileges required
SINGLE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |
Common Weakness Enumeration (CWE)
Nessus
| NASL family | Windows |
| NASL id | SYMANTEC_MANAGEMENT_CONSOLE_XSS_XXE.NASL |
| description | The version of Symantec Manager Console running on the remote host is earlier then ITM 8.1 RU1, ITMS 8.0_POST_HF6 or ITMS 7.6_POST_HF7 and is therefore affected by multiple cross-site scripting (XSS) and XML External Entity (XXE) processing vulnerabilities. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 102203 |
| published | 2017-08-04 |
| reporter | This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/102203 |
| title | Symantec Management Console Multiple XSS and XXE Vulnerabilities (SYM17-005) |