Symantec Web Gateway is prone to a command-injection vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary OS commands in the context of the affected appliance.

Updatei to 5.2.2 or higher.

Symantec was notified of an OS command injection vulnerability in PHP script which impacts the SWG management console. The results of successful exploitation could potentially range from unauthorized disclosure of sensitive data to possible unauthorized access to the Symantec Web Gateway Appliance.

Versions prior to Symantec Web Gateway 5.2.2 are vulnerable.

Check the version

• http://www.securityfocus.com/bid/71620
• http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20141216_00

---

Updated on 2015-03-25