CVE-2012-4347: Symantec Messaging Gateway management console path traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityThe flaw requires authentication and only yields file disclosure, but public exploit references and a very high EPSS score raise the practical risk for exposed consoles.

What it is

The Symantec Messaging Gateway 9.5.x management console contains multiple directory traversal flaws. An authenticated user can supply a .. sequence in the logFile parameter of a logs action to brightmail/export or the localBackupFileSelection parameter of an APPLIANCE restoreSource action to brightmail/admin/restore/download.do, causing the appliance to read files outside the intended directory. Because the console handles mail security configuration and logs, leaked files can expose sensitive operational data.

Impact

An attacker with a valid console account gains read access to arbitrary files on the appliance, which can reveal configuration, credentials or log data useful for further compromise. There is no write, code execution or denial-of-service impact described.

Attack surface

Reachable over the network through the SMG management console web interface; the description states remote authenticated users, so a valid account is required and no user interaction beyond sending the crafted request is indicated. The CVSS 2.0 vector AV:N/AC:L/Au:N/C:P/I:N/A:N is inconsistent with the authenticated requirement in the description.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but the EPSS 30-day probability is 0.5883 (99th percentile) and SecurityFocus references are tagged Exploit, indicating public exploit interest. No confirmed in-the-wild exploitation is documented in this record.

What to do

• Apply the Symantec security advisory update for SMG 9.5.x referenced in the record; patch first.
• Restrict management console access to trusted administrative networks and remove or disable unused accounts.
• Validate and canonicalize file path parameters on the export and restore endpoints, rejecting traversal sequences.
• Monitor and alert on anomalous file-read requests to brightmail/export and brightmail/admin/restore/download.do.

Detection

• Review web logs for requests to brightmail/export or brightmail/admin/restore/download.do containing .. or encoded traversal sequences in logFile or localBackupFileSelection.
• Alert on management console file reads outside expected log or backup directories.
• Audit authenticated console sessions for unusual export or restore activity from unexpected source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.