ID |
CVE-2013-5014
|
Summary |
The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
References |
|
Vulnerable Configurations |
-
cpe:2.3:a:symantec:endpoint_protection_manager:11.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:endpoint_protection_manager:11.0:*:*:*:*:*:*:*
-
cpe:2.3:a:symantec:endpoint_protection_manager:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:symantec:endpoint_protection_manager:12.1.0:*:*:*:*:*:*:*
-
cpe:2.3:a:symantec:endpoint_protection_manager:12.1.1:*:*:*:*:*:*:*
cpe:2.3:a:symantec:endpoint_protection_manager:12.1.1:*:*:*:*:*:*:*
-
cpe:2.3:a:symantec:endpoint_protection_manager:12.1.2:*:*:*:*:*:*:*
cpe:2.3:a:symantec:endpoint_protection_manager:12.1.2:*:*:*:*:*:*:*
-
cpe:2.3:a:symantec:endpoint_protection_manager:12.1.3:*:*:*:*:*:*:*
cpe:2.3:a:symantec:endpoint_protection_manager:12.1.3:*:*:*:*:*:*:*
-
cpe:2.3:a:symantec:protection_center:12.0:*:*:*:small_business:*:*:*
cpe:2.3:a:symantec:protection_center:12.0:*:*:*:small_business:*:*:*
|
CVSS |
Base: | 7.5 (as of 26-03-2014 - 04:51) |
Impact: | |
Exploitability: | |
|
CWE |
NVD-CWE-Other |
CAPEC |
|
Access |
Vector | Complexity | Authentication |
NETWORK |
LOW |
NONE |
|
Impact |
Confidentiality | Integrity | Availability |
PARTIAL |
PARTIAL |
PARTIAL |
|
cvss-vector
via4
|
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
refmap
via4
|
|
saint
via4
|
bid | 65466 | description | Symantec Endpoint Protection Manager XXE and SQL Injection Vulnerabilities | osvdb | 103306 | title | symantec_epm_xxe_sql_inj | type | remote |
|
Last major update |
26-03-2014 - 04:51 |
Published |
14-02-2014 - 13:10 |
Last modified |
26-03-2014 - 04:51 |