Lucene search

[email protected]CVE-2015-8157

HistoryJun 08, 2016 - 2:59 p.m.

CVE-2015-8157

2016-06-0814:59:00

CWE-89

[email protected]

web.nvd.nist.gov

sql injection

symantec

vulnerability

ses:csp

scsp

data center security

dcs:sa

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.8%

JSON

SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Affected configurations

NVD

Node

broadcomsymantec_critical_system_protectionRange≤5.2.9

broadcomsymantec_data_center_security_serverMatch6.5.0advanced

broadcomsymantec_data_center_security_serverMatch6.6.0advanced

broadcomsymantec_data_center_security_server_and_agentsRange≤6.6.0advanced

broadcomsymantec_embedded_security_critical_system_protectionRange≤1.0

broadcomsymantec_embedded_security_critical_system_protection_for_controllers_and_devicesRange≤6.5.0

CPENameOperatorVersion
broadcom:symantec_critical_system_protectionbroadcom symantec critical system protectionle5.2.9
broadcom:symantec_data_center_security_serverbroadcom symantec data center security servereq6.5.0
broadcom:symantec_data_center_security_serverbroadcom symantec data center security servereq6.6.0
broadcom:symantec_data_center_security_server_and_agentsbroadcom symantec data center security server and agentsle6.6.0
broadcom:symantec_embedded_security_critical_system_protectionbroadcom symantec embedded security critical system protectionle1.0
broadcom:symantec_embedded_security_critical_system_protection_for_controllers_and_devicesbroadcom symantec embedded security critical system protection for controllers and devicesle6.5.0

CPE	Name	Operator	Version
broadcom:symantec_critical_system_protection	broadcom symantec critical system protection	le	5.2.9
broadcom:symantec_data_center_security_server	broadcom symantec data center security server	eq	6.5.0
broadcom:symantec_data_center_security_server	broadcom symantec data center security server	eq	6.6.0
broadcom:symantec_data_center_security_server_and_agents	broadcom symantec data center security server and agents	le	6.6.0
broadcom:symantec_embedded_security_critical_system_protection	broadcom symantec embedded security critical system protection	le	1.0
broadcom:symantec_embedded_security_critical_system_protection_for_controllers_and_devices	broadcom symantec embedded security critical system protection for controllers and devices	le	6.5.0

References

www.securityfocus.com/bid/90889

www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160607_00

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.8%

JSON

Related for CVE-2015-8157

nvd1 prion1 cvelist1 symantec1 nessus1