CVE-2014-1648

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-04-23 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in brightmail/setting/compliance/DlpConnectFlow$view.flo in the management console in Symantec Messaging Gateway 10.x before 10.5.2 allows remote attackers to inject arbitrary web script or HTML via the displayTab parameter.

Affected products

Symantec Messaging Gateway: 10.0, 10.0.1, 10.0.2, 10.0.3, 10.5.0, 10.5.1

References

http://seclists.org/fulldisclosure/2014/Apr/256
http://www.securityfocus.com/bid/66966
http://www.securitytracker.com/id/1030136
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140422_00
http://seclists.org/fulldisclosure/2014/Apr/256
http://www.securityfocus.com/bid/66966
http://www.securitytracker.com/id/1030136
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140422_00

Get alerted when CVE-2014-1648 or the next vulnerability affects your stack