CVE-2018-12246 Vulnerability Details

  /     /     /  

CVE-2018-12246 Metadata Quick Info

CVE Published: 22/10/2018 | CVE Updated: 16/09/2024 | CVE Year: 2018
Source: symantec | Vendor: Symantec Corporation | Product: Symantec Web Isolation
Status : PUBLISHED

---

CVE-2018-12246 Description

Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious JavaScript code into the website\'s rendered copy running inside the end user\'s web browser. It does not allow injecting code into the real (isolated) copy of the website running on the WI Threat Isolation Engine.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: Cross-site scripting (XSS)
Source: Symantec Corporation

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).