Vulnerability record · CVE-2012-0299 · published 21 May 2012
CVE-2012-0299: Symantec Web Gateway GUI file-management scripts allow arbitrary code upload
Symantec · Web Gateway
The file-management scripts in the management GUI of Symantec Web Gateway 5.0.x before 5.0.3 permit remote attackers to upload arbitrary code to a designated pathname, with possible execution. Because the management interface is network-reachable and the flaw is an access-control weakness, it exposes the appliance to full compromise.
Description
The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a designated pathname, and possibly execute this code, via unspecified vectors.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 10.0 with network reachability, no authentication required, and complete impact, combined with a 99th-percentile EPSS score, makes this a top remediation priority.
What it is
The file-management scripts in the management GUI of Symantec Web Gateway 5.0.x before 5.0.3 permit remote attackers to upload arbitrary code to a designated pathname, with possible execution. Because the management interface is network-reachable and the flaw is an access-control weakness, it exposes the appliance to full compromise.
Impact
An attacker can place arbitrary code on the appliance and possibly execute it, which per the CVSS vector yields complete loss of confidentiality, integrity and availability of the affected system.
Attack surface
Reached over the network via the management GUI's file-management scripts; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required, though the description does not specify the exact request path.
Exploitation
Not listed in CISA KEV and no exploit references are tagged, but EPSS is 0.64061 (99th percentile), indicating a high modeled likelihood of exploitation activity.
What to do
- Upgrade Symantec Web Gateway to 5.0.3 or later per the vendor advisory.
- Restrict network access to the management GUI to trusted administrative hosts or an isolated management VLAN.
- Disable or block the file-management functionality if it is not operationally required.
- Monitor and audit the designated upload pathname for unexpected files and remove any unauthorized content.
- Review appliance logs for anomalous upload requests and treat any as a potential compromise.
Detection
- Alert on file-upload requests to the management GUI file-management scripts from untrusted source addresses.
- Monitor the designated upload pathname for new or modified executable files.
- Baseline and watch for unexpected processes or outbound connections originating from the Web Gateway appliance.
- Correlate web server logs for the management interface with file-system change events on the appliance.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-0299 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-0299), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
