by Kastro
Paper/Archive/CVE-2021-46825

CVE-2021-46825

symantec — Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability.

EPSS 2%CVSS 9.1
critical.is priorityof 100
43
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 76.4.764 × 2015.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web clients communicate through the proxy with the same web server, the attacker can send crafted HTTP requests and cause the proxy to forward web server responses to unintended clients. Severity/CVSSv3: High / 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected

ProductAffectedFixed inSource
Advance Secure Gateway and ProxySG6.7, 7.3–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refsupport.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/20638