7.5

CVE-2014-3437

Exploit

EPSS 22.28%
Veröffentlicht 07.11.2014 11:55:03
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle secure@symantec.com
CVE-Watchlists
Login
Unerledigt
Login

The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 9

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Symantec ≫ Endpoint Protection Manager Version <= 12.1.4

Symantec ≫ Endpoint Protection Manager Version12.1.0

Symantec ≫ Endpoint Protection Manager Version12.1.1

Symantec ≫ Endpoint Protection Manager Version12.1.2

Symantec ≫ Endpoint Protection Manager Version12.1.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	22.28%	0.953

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

http://seclists.org/fulldisclosure/2014/Nov/7

Exploit

http://www.securityfocus.com/archive/1/533918/100/0/threaded

http://www.securityfocus.com/bid/70843

http://www.securitytracker.com/id/1031176

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141105_00

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/98525

https://nvd.nist.gov/vuln/detail/CVE-2014-3437

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-3437

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-3437

EUVD