CVE-2011-0550 — Cross-site Scripting in Endpoint Protection

CWE-79 — Cross-site Scripting3 documents3 sources

Severity

4.3MEDIUMNVD

EPSS

0.7%

top 27.51%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Symantec Endpoint Protection

Timeline

PublishedAug 15

Latest updateMay 17

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.6300 allow remote attackers to inject arbitrary web script or HTML via (1) the token parameter to portal/Help.jsp or (2) the URI in a console/apps/sepm request.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDsymantec/endpoint_protection5 versions+4

🔴Vulnerability Details

GHSA

GHSA-5683-7cr4-v2pp: Multiple cross-site scripting (XSS) vulnerabilities in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11↗2022-05-17

▶

CVEList

CVE-2011-0550: Multiple cross-site scripting (XSS) vulnerabilities in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11↗2011-08-15

▶