ID CVE-2013-5014
Summary The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
References
Vulnerable Configurations
  • cpe:2.3:a:symantec:endpoint_protection_manager:11.0:*:*:*:*:*:*:*
    cpe:2.3:a:symantec:endpoint_protection_manager:11.0:*:*:*:*:*:*:*
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:symantec:endpoint_protection_manager:12.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:symantec:endpoint_protection_manager:12.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:symantec:endpoint_protection_manager:12.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:symantec:endpoint_protection_manager:12.1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:symantec:protection_center:12.0:*:*:*:small_business:*:*:*
    cpe:2.3:a:symantec:protection_center:12.0:*:*:*:small_business:*:*:*
CVSS
Base: 7.5 (as of 26-03-2014 - 04:51)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 65466
confirm http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140213_00
exploit-db
  • 31853
  • 31917
misc https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140218-0_Symantec_Endpoint_Protection_Multiple_critical_vulnerabilities_wo_poc_v10.txt
saint via4
bid 65466
description Symantec Endpoint Protection Manager XXE and SQL Injection Vulnerabilities
osvdb 103306
title symantec_epm_xxe_sql_inj
type remote
Last major update 26-03-2014 - 04:51
Published 14-02-2014 - 13:10
Last modified 26-03-2014 - 04:51
Back to Top