CVE-2014-3440

EPSS 0.94%
Published 21.01.2015 15:17:00
Last modified 12.04.2025 10:46:40
Source secure@symantec.com
Teams watchlist Login
Open Login

The Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x before 6.0 MP1 allows remote authenticated users to execute arbitrary commands by leveraging client-system access to upload a log file.

Affected products Warnungen 0 Metrics 2 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Broadcom ≫ Symantec Critical System Protection Version5.2.9

Symantec ≫ Data Center Security Version6.0.0 SwEditionserver_advanced

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.94%	0.744

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9	8	10	AV:N/AC:L/Au:S/C:C/I:C/A:C

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://seclists.org/fulldisclosure/2015/May/39

http://www.securityfocus.com/bid/72091

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150119_00

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2014-3440

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-3440

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-3440

EUVD