CVE-2020-12595

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-10 · updated 2026-06-17

Description

An information disclosure flaw allows a malicious, authenticated, privileged web UI user to obtain a password for a remote SCP backup server that they might not otherwise be authorized to access. This affects SMG prior to 10.7.4.

Affected products

Symantec Messaging Gateway (SMG): before 10.7.4 — fixed in 10.7.4

How to fix

Upgrade to a fixed version: Symantec Messaging Gateway (SMG) 10.7.4. Check the vendor advisory for mitigations.

References

https://support.broadcom.com/security-advisory/content/security-advisories/Privilege-Escalation-and-Information-Disclosure-Vulnerabilities-in-SMG/SYMSA16609
https://support.broadcom.com/security-advisory/content/security-advisories/Privilege-Escalation-and-Information-Disclosure-Vulnerabilities-in-SMG/SYMSA16609

Get alerted when CVE-2020-12595 or the next vulnerability affects your stack