CVE-2018-18370
Description
The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web listing of a remote FTP server. Exploiting the vulnerability requires the attacker to be able to upload crafted files to the remote FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2.
How to fix
- broadcom advanced_secure_gateway6.7.4.2 or later
- broadcom symantec_proxysg6.5.10.15, 6.7.4.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom advanced_secure_gateway | 6.7 ≤ v < 6.7.4.2, 6.6 | 6.7.4.2 |
| broadcom symantec_proxysg | 6.5 ≤ v < 6.5.10.15, 6.7 ≤ v < 6.7.4.2, 6.6 | 6.5.10.15, 6.7.4.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.