CVE-2014-7285

The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

50.32% chance of exploitation in the next 30 days, 99th percentile

Published

2014-12-17

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/36263

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/symantec_web_gateway_…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/36263

References

• CVE Record
• NVD entry

Related

• CVE-2014-7281
• CVE-2014-7286
• CVE-2014-7280
• CVE-2014-7288
• CVE-2014-7279
• CVE-2014-7289