Read the docs
TI-2018-08782 Aliases CVE-2018-12243GHSA-82xf-qv3c-486v

XML external entity injection in Symantec Messaging Gateway

Priority LOW 39CWE-611Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input containing a reference to an external entity is processed by a weakly configured XML parser. The attack uses file URI schemes or relative paths in the system identifier to access files that should not normally be accessible.

Why it matters now

EPSS 0.00767 55th percentileScored 2026-11-07
Fix Fixed Symantec Messaging Gateway (Symantec Corporation): 10.6.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecSymantec Messaging Gatewaybefore 10.6.610.6.6Patch availableCNA
  • Symantec Messaging Gateway VendorSymantec Affected before 10.6.6 Fixed in 10.6.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:symantec:messaging_gateway:*:*:*:*:*:*:*:*before 10.6.6VulnerableSymantec
  • cpe:2.3:a:symantec:messaging_gateway:*:*:*:*:*:*:*:* Versions before 10.6.6 Vulnerable ·Symantec

Remediation

  • Fix · CNA Symantec Messaging Gateway (Symantec Corporation) Fixed in 10.6.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-12243
  2. 2026-10-03 Alias added: GHSA-82xf-qv3c-486v

References

Advisory 1

  • TI-2017-04156 The Symantec Messaging Gateway can encounter an issue of remote code execution, which… CVSS 3.0CRITICAL 10.0
  • TI-2012-03102 Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified… CVSS 2.0HIGH 7.9
  • TI-2016-04608 Directory traversal vulnerability in the charting component in Symantec Messaging Gateway… CVSS 3.0MEDIUM 6.5
  • TI-2012-03702 Multiple directory traversal vulnerabilities in the management console in Symantec… CVSS 2.0MEDIUM 5.0
  • TI-2018-08781 Improper authentication in Symantec Messaging Gateway CVSS 3.0CRITICAL 9.8
  • TI-2012-05122 Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in… CVSS 3.1HIGH 7.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences