CVE-2022-25630

🗓️ 09 Dec 2022 00:00:00Reported by symantecType

cve🔗 web.nvd.nist.gov👁 62 Views🌐 WEB

An authenticated user can embed malicious content with XSS into the admin group policy page

Reporter	Title	Published	Views	Family All 12
0day.today	Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting Vulnerability	8 Apr 202300:00	–	zdt
Circl	CVE-2022-25630	9 Dec 202220:18	–	circl
CNNVD	Broadcom Symantec Messaging Gateway 跨站脚本漏洞	9 Dec 202200:00	–	cnnvd
Cvelist	CVE-2022-25630	9 Dec 202200:00	–	cvelist
Exploit DB	Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)	8 Apr 202300:00	–	exploitdb
EUVD	EUVD-2022-30290	3 Oct 202520:07	–	euvd
NVD	CVE-2022-25630	9 Dec 202218:15	–	nvd
Packet Storm	Symantec Messaging Gateway 10.7.4 Cross Site Scripting	10 Apr 202300:00	–	packetstorm
Prion	Code injection	9 Dec 202218:15	–	prion
Positive Technologies	PT-2022-17423 · Symantec · Messaging Gateway	9 Dec 202200:00	–	ptsecurity

NVD

Node

symantec messaging_gatewayRange<10.8

[
  {
    "vendor": "n/a",
    "product": "Symantec Messaging Gateway",
    "versions": [
      {
        "version": "All releases prior to SMG 10.8",
        "status": "affected"
      }
    ]
  }
]

Source	Link
support	www.support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21117
packetstormsecurity	www.packetstormsecurity.com/files/171781/Symantec-Messaging-Gateway-10.7.4-Cross-Site-Scripting.html

Parameter	Position	Path	Description	CWE
adminGroupName	request body	brightmail/admin/administration/AdminGroupPolicyFlow$save.flo	Stored XSS via adminGroupPolicyFlow save endpoint injecting HTML/JS in group policy fields	CWE-79
adminGroupDescription	request body	brightmail/admin/administration/AdminGroupPolicyFlow$save.flo	Stored XSS via adminGroupPolicyFlow save endpoint injecting HTML/JS in group policy fields	CWE-79

23 Apr 2025 15:15Current

5.1Medium risk

Vulners AI Score5.1

CVSS 3.15.4

EPSS0.01879

SSVC

CWE-79