Read the docs
TI-2017-11354 Aliases CVE-2017-15532GHSA-r35f-v6j3-28f5

Path traversal in Symantec Messaging Gateway

Priority LOW 28CWE-22Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack (also known as directory traversal). These types of attacks aim to access files and directories that are stored outside the web root folder. By manipulating variables, it may be possible to access arbitrary files and directories stored on the file system including application source code or configuration and critical system files.

Why it matters now

EPSS 0.01372 72nd percentileScored 2026-11-07
Fix Fixed Messaging Gateway (Symantec Corporation): 10.6.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecMessaging Gatewaybefore 10.6.410.6.4Patch availableCNA
  • Messaging Gateway VendorSymantec Affected before 10.6.4 Fixed in 10.6.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:symantec:messaging_gateway:*:*:*:*:*:*:*:*before 10.6.4VulnerableSymantec
  • cpe:2.3:a:symantec:messaging_gateway:*:*:*:*:*:*:*:* Versions before 10.6.4 Vulnerable ·Symantec

Remediation

  • Fix · CNA Messaging Gateway (Symantec Corporation) Fixed in 10.6.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-15532
  2. 2026-10-03 Alias added: GHSA-r35f-v6j3-28f5

References

Advisory 1

  • TI-2017-04156 The Symantec Messaging Gateway can encounter an issue of remote code execution, which… CVSS 3.0CRITICAL 10.0
  • TI-2012-03102 Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified… CVSS 2.0HIGH 7.9
  • TI-2016-04608 Directory traversal vulnerability in the charting component in Symantec Messaging Gateway… CVSS 3.0MEDIUM 6.5
  • TI-2012-03702 Multiple directory traversal vulnerabilities in the management console in Symantec… CVSS 2.0MEDIUM 5.0
  • TI-2018-08781 Improper authentication in Symantec Messaging Gateway CVSS 3.0CRITICAL 9.8
  • TI-2012-05122 Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in… CVSS 3.1HIGH 7.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences