CVE-2013-5015

2014-02-1413:10:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2013-5015

vulnerability

sql injection

symantec endpoint protection manager

sepm 11.0

symantec protection center small business edition 12.x

nvd

7.5 High

AI Score

Confidence

Low

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

77.6%

JSON

SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

CPENameOperatorVersion
symantec:protection_centersymantec protection centereq12.0
symantec:endpoint_protection_managersymantec endpoint protection managereq11.0
symantec:endpoint_protection_managersymantec endpoint protection managereq12.1.0
symantec:endpoint_protection_managersymantec endpoint protection managereq12.1.1
symantec:endpoint_protection_managersymantec endpoint protection managereq12.1.3
symantec:endpoint_protection_managersymantec endpoint protection managereq12.1.2

CPE	Name	Operator	Version
symantec:protection_center	symantec protection center	eq	12.0
symantec:endpoint_protection_manager	symantec endpoint protection manager	eq	11.0
symantec:endpoint_protection_manager	symantec endpoint protection manager	eq	12.1.0
symantec:endpoint_protection_manager	symantec endpoint protection manager	eq	12.1.1
symantec:endpoint_protection_manager	symantec endpoint protection manager	eq	12.1.3
symantec:endpoint_protection_manager	symantec endpoint protection manager	eq	12.1.2

References

osvdb.org/103306

www.exploit-db.com/exploits/31853

www.exploit-db.com/exploits/31917

www.securityfocus.com/bid/65467

www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140213_00

www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140218-0_Symantec_Endpoint_Protection_Multiple_critical_vulnerabilities_wo_poc_v10.txt