Read the docs
TI-2019-13378 Aliases CVE-2019-18375GHSA-56qq-4q2h-c244

The ASG and ProxySG management consoles are susceptible to a session hijacking…

Priority LOW 31Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with access to the appliance management interface, can hijack the session of a currently logged-in user and access the management console.

Why it matters now

EPSS 0.01262 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Symantec Advanced Secure Gateway (ASG) and ProxySGASG 6.7.4 prior to 6.7.4.10, ASG 7.x prior to 7.2.0.1, ProxySG 6.7.4 prior to 6.7.4.10, ProxySG 7.x prior to 7.2.0.1—No fix listedCNA
  • Symantec Advanced Secure Gateway (ASG) and ProxySG Vendor— Affected ASG 6.7.4 prior to 6.7.4.10, ASG 7.x prior to 7.2.0.1, ProxySG 6.7.4 prior to 6.7.4.10, ProxySG 7.x prior to 7.2.0.1 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:broadcom:advanced_secure_gateway:*:*:*:*:*:*:*:*6.7.4 to before 6.7.4.10; 7.1 to before 7.2.0.1VulnerableBroadcom
cpe:2.3:a:broadcom:symantec_proxysg:*:*:*:*:*:*:*:*6.7.4 to before 6.7.4.10; 7.1 to before 7.2.0.1VulnerableBroadcom
  • cpe:2.3:a:broadcom:advanced_secure_gateway:*:*:*:*:*:*:*:* Versions 6.7.4 to before 6.7.4.10; 7.1 to before 7.2.0.1 Vulnerable ·Broadcom
  • cpe:2.3:a:broadcom:symantec_proxysg:*:*:*:*:*:*:*:* Versions 6.7.4 to before 6.7.4.10; 7.1 to before 7.2.0.1 Vulnerable ·Broadcom

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-18375
  2. 2026-10-03 Alias added: GHSA-56qq-4q2h-c244

References

Advisory 1

  • TI-2023-09749 Command injection in Advanced Secure Gateway, Content Analysis CVSS 3.1CRITICAL 9.8
  • TI-2018-03798 Symantec Advanced Secure Gateway (ASG) 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are… CVSS 3.0CRITICAL 9.8
  • TI-2021-21518 Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync… CVSS 3.1CRITICAL 9.1
  • TI-2017-09955 Denial-of-service (DoS) vulnerability in the Symantec Advanced Secure Gateway (ASG) and… CVSS 3.0HIGH 7.5
  • TI-2023-09752 Server-side request forgery in Advanced Secure Gateway, Content Analysis CVSS 3.1HIGH 8.1
  • TI-2016-08332 Unrestricted file upload in Symantec Advanced Secure Gateway CVSS 3.0MEDIUM 6.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences