CVE-2016-5312

This bug lets someone who is already logged in to misuse a chart feature to “walk” through folders on the server and pull out files they shouldn’t see. Think of it like a sign-in visitor using a trick in the address bar to open any door in the building—rather than just the room they were meant to access.

This matters if your business runs Symantec Messaging Gateway and you have the charting component in use (versions before 10.6.2). Because exploitation requires a remote authenticated user, your risk is higher if an attacker could obtain valid access (for example, stolen credentials or an over-permissioned account).

Public exploits are available and there is a rising amount of press attention, which makes real-world testing and use more likely than before. Even though it requires an authenticated user, this is still a clear patch priority for anyone on versions earlier than 10.6.2.

1. Inventory and confirm exposure

• Identify whether Symantec Messaging Gateway is installed and in active use.
• Determine the exact installed version.
• Check whether the charting feature (ChartStream under brightmail/servlet/com.ve.kavachart.servlet.ChartStream) is reachable/enabled in your deployment.

2. Decide based on version

• If your version is earlier than 10.6.2, treat it as affected.
• If you are on 10.6.2 or later, this specific issue is addressed by the vendor fix.

3. Remediate

• Upgrade Symantec Messaging Gateway to 10.6.2 or later (follow the vendor’s standard upgrade procedure for your environment).
• After the upgrade, verify the running version in the system and confirm the charting component still works as expected.

4. If patching is delayed (temporary containment)

• Reduce which users/accounts can access the messaging gateway’s charting/admin functionality, since exploitation requires remote authentication.
• Review and tighten account permissions and authentication hygiene (e.g., remove unused accounts, enforce strong passwords, and ensure administrative accounts are not shared).

5. What to monitor

• Monitor access to the charting endpoint and review logs for unusual sn-like parameters (especially attempts containing traversal patterns).
• Watch for repeated 4xx/5xx errors or suspicious access patterns consistent with probing.

Note: This CVE is not listed in the CISA KEV catalog based on the provided findings.

Severity is listed as medium (CVSS 6.5). The weakness is CWE-22 (directory traversal). The attack vector involves manipulating the sn parameter so the charting servlet (ChartStream at brightmail/servlet/com.ve.kavachart.servlet.ChartStream) interprets .. traversal and reads arbitrary files. The findings indicate public exploit availability (3 known), and CISA KEV does not list this CVE. A predicted EPSS value exists in the findings, but it is not used as the basis for urgency here because exploitation signals are already present via public exploit availability and the AMBER triage.