CVE-2014-3437
HighSummary
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Risk Assessment
Attackers may gain access to sensitive data or perform attacks on intranet servers, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update Symantec Endpoint Protection Manager to version 12.1 RU5 or later to mitigate this vulnerability.
Other vulnerabilities in Symantec Endpoint Protection Manager (SEPM) 12.1
See all- CVE-2016-3653High
Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to hijack the authentication of arbitrary users.
- CVE-2016-3651High
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors.
- CVE-2016-3650High
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack.
- CVE-2016-3648High
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism. This enables brute-force password-guessing attacks against management-console accounts.
- CVE-2016-3647High
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, enabling them to trigger network traffic to arbitrary intranet hosts via a crafted request.
- CVE-2015-6555High
Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary Java code by connecting to the console Java port.
- CVE-2015-6554High
Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary OS commands via crafted data.
- CVE-2015-1489High
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before version 12.1-RU6-MP1 allows remote authenticated users to gain privileges via unspecified vectors.
- CVE-2015-1486High
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before version 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action, leading to a new administrative session.
Original NVD description (English source)
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.