Read the docs
TI-2018-12980 Aliases CVE-2018-18362GHSA-c6q8-mrx8-v92f

Cross-site scripting in Symantec Norton Password Manager

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Norton Password Manager for Android (formerly Norton Identity Safe) may be susceptible to a cross site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.

Why it matters now

EPSS 0.00908 60th percentileScored 2026-11-07
Fix Fixed Norton Password Manager (Symantec Corporation): 6.1.0.1045

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecNorton Password Managerbefore 6.1.0.10456.1.0.1045Patch availableCNA
  • Norton Password Manager VendorSymantec Affected before 6.1.0.1045 Fixed in 6.1.0.1045 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:symantec:norton_password_manager:*:*:*:*:*:android:*:*before 6.1.0.1045VulnerableSymantec
  • cpe:2.3:a:symantec:norton_password_manager:*:*:*:*:*:android:*:* Versions before 6.1.0.1045 Vulnerable ·Symantec

Remediation

  • Fix · CNA Norton Password Manager (Symantec Corporation) Fixed in 6.1.0.1045

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-18362
  2. 2026-10-03 Alias added: GHSA-c6q8-mrx8-v92f

References

Advisory 1

  • TI-2018-12983 Norton Password Manager may be susceptible to an address spoofing issue. CVSS 3.0HIGH 7.5
  • TI-2018-08779 Hard-coded credentials in Symantec Norton Identity Safe for Android CVSS 3.1MEDIUM 5.9
  • TI-2019-09544 Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences