CVE-2016-2203

The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD password by leveraging certain read privileges.

CVSS v3.0

7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

2.1 LOWAV:L/AC:L/Au:N/C:P/I:N/A:N

EPSS

7.06% chance of exploitation in the next 30 days, 94th percentile

Published

2016-04-22

Updated

2024-08-05

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/136758/Symantec-Brightmail-10.6.0-7-LDAP-Credential-…

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/symantec_brightmai…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/39715

References

• CVE Record
• NVD entry

Related

• CVE-2016-2188
• CVE-2016-2207
• CVE-2016-2186
• CVE-2016-2208
• CVE-2016-2185
• CVE-2016-2209