« Volver al listado

CVE-2019-18375

Estado: ModificadaMedia (6.5)—

The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interface, can hijack the session of a currently logged-in user and access the management console.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Broadcom — Advanced Secure GatewayBroadcom — Symantec Proxysg

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-18375",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secure@symantec.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Symantec Advanced Secure Gateway (ASG) and ProxySG",
          "versions": [
            {
              "status": "affected",
              "version": "ASG 6.7.4 prior to 6.7.4.10, ASG 7.x prior to 7.2.0.1, ProxySG 6.7.4 prior to 6.7.4.10, ProxySG 7.x prior to 7.2.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-04-10T00:15:11.160",
  "references": [
    {
      "url": "https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1752",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "https://support.broadcom.com/security-advisory/security-advisory-detail.html?notificationId=SYMSA1752",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interface, can hijack the session of a currently logged-in user and access the management console."
    },
    {
      "lang": "es",
      "value": "Las consolas de administración de ASG y ProxySG, son susceptibles a una vulnerabilidad de secuestro de sesión. Un atacante remoto, con acceso a la interfaz de administración del dispositivo, puede secuestrar la sesión de un usuario actualmente registrado y acceder a la consola de administración."
    }
  ],
  "lastModified": "2026-06-17T02:24:56.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:advanced_secure_gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E268AFF2-E368-4574-9CE4-923C9C510E24",
              "versionEndExcluding": "6.7.4.10",
              "versionStartIncluding": "6.7.4"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:advanced_secure_gateway:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED2A0D93-FEEC-43B1-9766-032B87E88C38",
              "versionEndExcluding": "7.2.0.1",
              "versionStartIncluding": "7.1"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:symantec_proxysg:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "250EAC78-79F0-4ACF-86DB-54A6826832A8",
              "versionEndExcluding": "6.7.4.10",
              "versionStartIncluding": "6.7.4"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:symantec_proxysg:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C91A22D-A943-4DA8-8557-1B4EDB392D09",
              "versionEndExcluding": "7.2.0.1",
              "versionStartIncluding": "7.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@symantec.com"
}