CVE-2016-3648
HighSummary
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism. This enables brute-force password-guessing attacks against management-console accounts.
Risk Assessment
The organization is at risk of unauthorized access to management accounts, which could lead to serious security breaches.
Recommendation
It is recommended to update Symantec Endpoint Protection Manager to the latest version to protect against these attacks.
Other vulnerabilities in Symantec Endpoint Protection Manager (SEPM) 12.1
See all- CVE-2016-3653High
Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to hijack the authentication of arbitrary users.
- CVE-2016-3651High
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors.
- CVE-2016-3650High
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack.
- CVE-2016-3647High
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, enabling them to trigger network traffic to arbitrary intranet hosts via a crafted request.
- CVE-2015-6555High
Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary Java code by connecting to the console Java port.
- CVE-2015-6554High
Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary OS commands via crafted data.
- CVE-2015-1489High
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before version 12.1-RU6-MP1 allows remote authenticated users to gain privileges via unspecified vectors.
- CVE-2015-1486High
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before version 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action, leading to a new administrative session.
- CVE-2014-3437High
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Original NVD description (English source)
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism, and conduct brute-force password-guessing attacks against management-console accounts, by entering data into the authorization window.