CVE-2012-0297
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access...
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.
Exploit likelihood
What each source reports
NVD Score used
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.
- Record
CVE-2012-0297- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.
- Record
CVE-2012-0297- Updated
- 2026-11-02
EUVDEUVD-2012-0333 No score
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.
- Record
EUVD-2012-0333- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ww7c-5x66-rfwr No score
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access...
The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.
- Record
GHSA-ww7c-5x66-rfwr- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Symantec Web Gateway 5.0.2 - Local/Remote File Inclusion / Remote Code Execution | 2012-05-26 |
| Exploit-DB | Symantec Web Gateway 5.0.2.8 - Command Execution (Metasploit) | 2012-05-28 |
| Exploit-DB | Symantec Web Gateway 5.0.2.8 - 'ipchange.php' Command Injection (Metasploit) | 2012-06-12 |
| Exploit-DB | symantec Web gateway 5.0.2.8 - Multiple Vulnerabilities | 2012-06-27 |
| Metasploit | Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection | 2012-05-17 |
| Metasploit | Symantec Web Gateway 5.0.2.8 relfile File Inclusion Vulnerability | 2012-05-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-0297 is a high vulnerability (CVSS 10.0) in Symantec Web Gateway, published May 21, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 73.0%, the 99th percentile. No source names a fixed version.