Read the docs
TI-2019-13380 Aliases CVE-2019-18377GHSA-28j2-jrj9-6xv4

Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation…

Priority LOW 34Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.

Why it matters now

EPSS 0.01402 72nd percentileScored 2026-11-07
Fix Fixed Symantec Messaging Gateway: 10.7.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Symantec Messaging Gatewaybefore 10.7.310.7.3Patch availableCNA
  • Symantec Messaging Gateway Vendor— Affected before 10.7.3 Fixed in 10.7.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:symantec:messaging_gateway:*:*:*:*:*:*:*:*before 10.7.3VulnerableSymantec
  • cpe:2.3:a:symantec:messaging_gateway:*:*:*:*:*:*:*:* Versions before 10.7.3 Vulnerable ·Symantec

Remediation

  • Fix · CNA Symantec Messaging Gateway Fixed in 10.7.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-18377
  2. 2026-10-03 Alias added: GHSA-28j2-jrj9-6xv4

References

Advisory 1

  • TI-2017-04156 The Symantec Messaging Gateway can encounter an issue of remote code execution, which… CVSS 3.0CRITICAL 10.0
  • TI-2012-03102 Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified… CVSS 2.0HIGH 7.9
  • TI-2016-04608 Directory traversal vulnerability in the charting component in Symantec Messaging Gateway… CVSS 3.0MEDIUM 6.5
  • TI-2012-03702 Multiple directory traversal vulnerabilities in the management console in Symantec… CVSS 2.0MEDIUM 5.0
  • TI-2018-08781 Improper authentication in Symantec Messaging Gateway CVSS 3.0CRITICAL 9.8
  • TI-2012-05122 Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in… CVSS 3.1HIGH 7.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences