CVE-2013-5014

🗓️ 14 Feb 2014 02:00:00Reported by symantecType

cve🔗 web.nvd.nist.gov👁 83 Views🌐 WEB

Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080 XXE issu

Reporter	Title	Published	Views	Family All 24
0day.today	Symantec Endpoint Protection Manager Remote Command Execution Exploit	24 Feb 201400:00	–	zdt
0day.today	Symantec Endpoint Protection Manager Remote Command Execution	26 Feb 201400:00	–	zdt
Circl	CVE-2013-5014	23 Feb 201400:00	–	circl
Check Point Advisories	Symantec Endpoint Protection Manager XML External Entity Denial Of Service (CVE-2013-5014)	11 Mar 201400:00	–	checkpoint_advisories
Cvelist	CVE-2013-5014	14 Feb 201402:00	–	cvelist
Exploit DB	Symantec Endpoint Protection Manager 11.0/12.0/12.1 - Remote Command Execution	23 Feb 201400:00	–	exploitdb
exploitpack	Symantec Endpoint Protection Manager 11.012.012.1 - Remote Command Execution	23 Feb 201400:00	–	exploitpack
Metasploit	Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution	25 Feb 201413:58	–	metasploit
NVD	CVE-2013-5014	14 Feb 201413:10	–	nvd
OpenVAS	Symantec Endpoint Protection Manager XXE and SQL Injection Vulnerabilities	20 Mar 201400:00	–	openvas

NVD

Node

symantec endpoint_protection_managerMatch11.0

symantec endpoint_protection_managerMatch12.1.0

symantec endpoint_protection_managerMatch12.1.1

symantec endpoint_protection_managerMatch12.1.2

symantec endpoint_protection_managerMatch12.1.3

symantec protection_centerMatch12.0small_business

Source	Link
exploit-db	www.exploit-db.com/exploits/31853
exploit-db	www.exploit-db.com/exploits/31917
sec-consult	www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140218-0_Symantec_Endpoint_Protection_Multiple_critical_vulnerabilities_wo_poc_v10.txt
symantec	www.symantec.com/security_response/securityupdates/detail.jsp
securityfocus	www.securityfocus.com/bid/65466

Parameter	Position	Path	Description	CWE
ActionType	request body	servlet/ConsoleServlet?ActionType=ConfigServer&action=test_av	XXE in ConsoleServlet allows remote attacker to trigger external entity and potentially execute commands	CWE-611
action	request body	servlet/ConsoleServlet?ActionType=ConfigServer&action=test_av	XXE in ConsoleServlet allows remote attacker to trigger external entity and potentially execute commands	CWE-611
Parameter	request body	servlet/ConsoleServlet?ActionType=ConfigServer&action=test_av	XXE in ConsoleServlet allows remote attacker to trigger external entity and potentially execute commands	CWE-611
ActionType	request body	servlet/ConsoleServlet?ActionType=ConsoleLog	XXE in ConsoleServlet used in multipart XML to exfiltrate or execute commands	CWE-611
ConsoleLog	request body	servlet/ConsoleServlet?ActionType=ConsoleLog	XXE in ConsoleServlet used in multipart XML to exfiltrate or execute commands	CWE-611
multipart body	request body	servlet/ConsoleServlet?ActionType=ConsoleLog	XXE in ConsoleServlet used in multipart XML to exfiltrate or execute commands	CWE-611
Parameter	request body	servlet/ConsoleServlet?ActionType=ConsoleLog	XXE in ConsoleServlet used in multipart XML to exfiltrate or execute commands	CWE-611

16 Jun 2026 23:58Current

6.5Medium risk

Vulners AI Score6.5

CVSS 27.5

EPSS0.67573