Symantec Gateway CSRF Admin Backdoor Flaw

Symantec Messaging Gateway 9.5.3-3 is affected by a CSRF vulnerability that allows an attacker to create a backdoor administrator account (via a crafted image tag) because GET/POST are interchangeable, sensitive functions lack password protection, and there is no CSRF protection; the report includes a proof-of-concept and notes that a fix was released.