High severity · published May 11, 2017
CVE-2016-9100
Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to 6.6.5.13, and ProxySG 6.7 prior to…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to 6.6.5.13, and ProxySG 6.7 prior to 6.7.3.1 are susceptible to an information disclosure vulnerability. An attacker with local access to the client host of an authenticated administrator user can, under certain circumstances, obtain sensitive authentication credential information.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Advanced Secure Gateway · Broadcom
6.6 before 6.6.5.13; 6.7 before 6.7.3.1 · source: NVD
SP
Symantec Proxysg · Broadcom
6.5 before 6.5.10.6; 6.6 before 6.6.5.13; 6.7 before 6.7.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9100
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9100
Third Party Advisory
http://www.securityfocus.com/bid/102454
Third Party Advisory
http://www.securitytracker.com/id/1040138
Vendor Advisory
https://www.symantec.com/security-center/network-protection-security-advisories/SA155
More from Advanced Secure Gateway
9.8
CVE-2023-23952
Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Command Injection vulnerability
9.8
CVE-2018-5241
Symantec Advanced Secure Gateway (ASG) 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability
9.1
CVE-2021-46825
Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability
8.1
CVE-2023-23955
Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to a Server-Side Request Forgery vulnerability
7.8
CVE-2023-23953
Advanced Secure Gateway and Content Analysis, prior to 7.3.13.1 / 3.1.6.0, may be susceptible to an Elevation of Privilege vulnerability