7.2

CVE-2012-4348

The management console in Symantec Endpoint Protection (SEP) 11.0 before RU7-MP3 and 12.1 before RU2, and Symantec Endpoint Protection Small Business Edition 12.x before 12.1 RU2, does not properly validate input for PHP scripts, which allows remote authenticated users to execute arbitrary code via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Symantec ≫ Endpoint Protection Version 11.0
Symantec ≫ Endpoint Protection Version 11.0 Update ru5
Symantec ≫ Endpoint Protection Version 11.0 Update ru6
Symantec ≫ Endpoint Protection Version 11.0 Update ru6a
Symantec ≫ Endpoint Protection Version 11.0 Update ru6mp1
Symantec ≫ Endpoint Protection Version 11.0 Update ru6mp2
Symantec ≫ Endpoint Protection Version 11.0.1
Symantec ≫ Endpoint Protection Version 11.0.1 Update mp1
Symantec ≫ Endpoint Protection Version 11.0.1 Update mp2
Symantec ≫ Endpoint Protection Version 11.0.2
Symantec ≫ Endpoint Protection Version 11.0.2 Update mp1
Symantec ≫ Endpoint Protection Version 11.0.2 Update mp2
Symantec ≫ Endpoint Protection Version 11.0.4
Symantec ≫ Endpoint Protection Version 11.0.4 Update mp1a
Symantec ≫ Endpoint Protection Version 11.0.4 Update mp2
Symantec ≫ Endpoint Protection Version 11.0.3001
Symantec ≫ Endpoint Protection Version 11.0.6000
Symantec ≫ Endpoint Protection Version 11.0.6100
Symantec ≫ Endpoint Protection Version 11.0.6200
Symantec ≫ Endpoint Protection Version 11.0.6200.754
Symantec ≫ Endpoint Protection Version 11.0.6300
Symantec ≫ Endpoint Protection Version 11.0.7000
Symantec ≫ Endpoint Protection Version 11.0.7100
Symantec ≫ Endpoint Protection Version 12.1
Symantec ≫ Endpoint Protection Version 12.1.671
Symantec ≫ Endpoint Protection Version 12.1.1000
Symantec ≫ Endpoint Protection Version 12.0 Update - Edition small_business
Symantec ≫ Endpoint Protection Version 12.1 Update - Edition small_business
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.16% 0.631
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 4.1 10
AV:A/AC:L/Au:M/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121210_00
http://www.securityfocus.com/bid/56846
http://www.securitytracker.com/id?1027863