CVE-2017-6327

🗓️ 11 Aug 2017 20:00:00Reported by symantecType

cve🔗 web.nvd.nist.gov👁 928 Views🌐 WEB

Symantec Messaging Gateway before 10.6.3-267 allows remote code execution

Reporter	Title	Published	Views	Family All 26
0day.today	Symantec Messaging Gateway 10.6.3-2 - Unauthenticated root Remote Command Execution	19 Aug 201700:00	–	zdt
ICS	Potential for China Cyber Response to Heightened U.S.–China Tensions	20 Oct 202012:00	–	ics
ATTACKERKB	CVE-2017-6327	11 Aug 201700:00	–	attackerkb
BDU FSTEC	The vulnerability of the goform/formEMR30 component of the Symantec Messaging Gateway, which exists due to insufficient validation of input data, allows a perpetrator to execute arbitrary code or escalate their privileges.	27 Apr 202200:00	–	bdu_fstec
canvas	Immunity Canvas: BRIGHTMAIL_RESTORE	11 Aug 201720:29	–	canvas
Circl	CVE-2017-6327	11 Aug 201717:17	–	circl
CISA KEV Catalog	Symantec Messaging Gateway Remote Code Execution Vulnerability	3 Nov 202100:00	–	cisa_kev
CNVD	Symantec Messaging Gateway Remote Code Execution Vulnerability (CNVD-2017-28446)	14 Aug 201700:00	–	cnvd
Check Point Advisories	Symantec Messaging Gateway performRestore Command Injection (CVE-2017-6327)	3 Sep 201700:00	–	checkpoint_advisories
Cvelist	CVE-2017-6327	11 Aug 201720:00	–	cvelist

NVD

Node

symantec message_gatewayRange<10.6.3-267

[
  {
    "product": "Messaging Gateway",
    "vendor": "Symantec Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to version 10.6.3-267"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/100135
symantec	www.symantec.com/security_response/securityupdates/detail.jsp
seclists	www.seclists.org/fulldisclosure/2017/Aug/28
exploit-db	www.exploit-db.com/exploits/42519/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
notify	query param	/brightmail/action1.do?method=notificationLogin&notify=	Unauthenticated GET request can reach public methods; notificationLogin uses decrypted notify to log in as a user, bypassing authentication.	CWE-77
method	query param	/brightmail/action1.do?method=notificationLogin&notify=	Unauthenticated GET request can reach public methods; notificationLogin uses decrypted notify to log in as a user, bypassing authentication.	CWE-77
localBackupFileSelection	query param	/brightmail/admin/restore/action5.do?method=performRestore&restoreSource=APPLIANCE&localBackupFileSelection=	Command injection via localBackupFileSelection in performRestore, leading to execution of arbitrary commands on the server.	CWE-77
restoreSource	query param	/brightmail/admin/restore/action5.do?method=performRestore&restoreSource=APPLIANCE&localBackupFileSelection=	Command injection via localBackupFileSelection in performRestore, leading to execution of arbitrary commands on the server.	CWE-77
method	query param	/brightmail/admin/restore/action5.do?method=performRestore&restoreSource=APPLIANCE&localBackupFileSelection=	Command injection via localBackupFileSelection in performRestore, leading to execution of arbitrary commands on the server.	CWE-77
symantec.brightmail.key.TOKEN	query param	/brightmail/admin/restore/action5.do?method=performRestore&restoreSource=APPLIANCE&localBackupFileSelection=	Command injection via localBackupFileSelection in performRestore, leading to execution of arbitrary commands on the server.	CWE-77

17 Jun 2026 01:22Current

8.8High risk

Vulners AI Score8.8

CVSS 26.5

CVSS 3.18.8

EPSS0.35341

SSVC