{"id":"CVE-2017-6328","aliases":["EUVD-2017-15389","GHSA-v26p-6c8q-68r2"],"status":"published","title":"The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request...","description":"The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02139,"percentile":0.82148,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-352"],"published":"2017-08-11T20:00:00Z","modified":"2026-06-17T01:22:09Z","exploits":[{"source":"exploitdb","id":"EDB-42613","title":"Symantec Messaging Gateway \u003c 10.6.3-267 - Cross-Site Request Forgery","type":"webapps","platform":"multiple","date":"2017-08-09","verified":true,"url":"https://www.exploit-db.com/exploits/42613"}],"products":[{"vendor":"symantec","product":"message_gateway"},{"vendor":"symantec corporation","product":"messaging gateway"}],"references":[{"url":"http://www.securityfocus.com/bid/100136","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=\u0026suid=20170810_00","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6328"},{"url":"https://github.com/advisories/GHSA-v26p-6c8q-68r2"}],"sources":{"cve":[{"id":"CVE-2017-6328","description":"The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser.","status":"published","published":"2017-08-11T20:00:00Z","modified":"2024-09-16T22:19:46.147Z","updated_at":"2026-11-02T14:33:16.578111Z"}],"euvd":[{"id":"EUVD-2017-15389","description":"The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser.","status":"published","published":"2017-08-11T20:00:00Z","modified":"2024-09-16T22:19:46Z","updated_at":"2026-11-03T00:55:04.418269Z"}],"ghsa":[{"id":"GHSA-v26p-6c8q-68r2","title":"The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request...","description":"The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser.","status":"published","published":"2022-05-17T01:57:37Z","modified":"2023-02-03T05:06:18Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:53:52.731364Z"}],"nvd":[{"id":"CVE-2017-6328","description":"The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser.","status":"published","published":"2017-08-11T20:29:00.237Z","modified":"2026-06-17T01:22:09.82Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:03:57.82609Z"}]}}