7.2

CVE-2013-5011

Unquoted Windows search path vulnerability in the client in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoint Protection Small Business Edition 12.x before 12.1.2 RU2 allows local users to gain privileges via a crafted program in the %SYSTEMDRIVE% directory.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Symantec ≫ Endpoint Protection Version <= 11.0.7.3
Symantec ≫ Endpoint Protection Version 11.0
Symantec ≫ Endpoint Protection Version 11.0 Update ru5
Symantec ≫ Endpoint Protection Version 11.0 Update ru6
Symantec ≫ Endpoint Protection Version 11.0 Update ru6a
Symantec ≫ Endpoint Protection Version 11.0 Update ru6mp1
Symantec ≫ Endpoint Protection Version 11.0 Update ru6mp2
Symantec ≫ Endpoint Protection Version 11.0.1
Symantec ≫ Endpoint Protection Version 11.0.1 Update mp1
Symantec ≫ Endpoint Protection Version 11.0.1 Update mp2
Symantec ≫ Endpoint Protection Version 11.0.2
Symantec ≫ Endpoint Protection Version 11.0.2 Update mp1
Symantec ≫ Endpoint Protection Version 11.0.2 Update mp2
Symantec ≫ Endpoint Protection Version 11.0.4
Symantec ≫ Endpoint Protection Version 11.0.4 Update mp1a
Symantec ≫ Endpoint Protection Version 11.0.4 Update mp2
Symantec ≫ Endpoint Protection Version 11.0.3001
Symantec ≫ Endpoint Protection Version 11.0.6000
Symantec ≫ Endpoint Protection Version 11.0.6100
Symantec ≫ Endpoint Protection Version 11.0.6200
Symantec ≫ Endpoint Protection Version 11.0.6200.754
Symantec ≫ Endpoint Protection Version 11.0.6300
Symantec ≫ Endpoint Protection Version 11.0.7000
Symantec ≫ Endpoint Protection Version 11.0.7100
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.372
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140109_00
Vendor Advisory
http://www.securityfocus.com/bid/64130
https://exchange.xforce.ibmcloud.com/vulnerabilities/90226