CVE-2012-4348 — Improper Input Validation in Endpoint Protection

CWE-20 — Improper Input ValidationCWE-662 — Improper SynchronizationCWE-362 — Race ConditionCWE-672 — Operation on a Resource after Expiration or ReleaseCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources
Severity
7.2HIGHNVD
EPSS
2.5%
top 14.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Symantec Endpoint Protection
Timeline
PublishedDec 18
Latest updateMay 17

Description

The management console in Symantec Endpoint Protection (SEP) 11.0 before RU7-MP3 and 12.1 before RU2, and Symantec Endpoint Protection Small Business Edition 12.x before 12.1 RU2, does not properly validate input for PHP scripts, which allows remote authenticated users to execute arbitrary code via unspecified vectors.

CVSS vector

AV:A/AC:L/C:C/I:C/A:CExploitability: 4.1 | Impact: 10.0

Affected Packages1 packages

▶NVDsymantec/endpoint_protection16 versions+15

🔴Vulnerability Details

2
GHSA
GHSA-58f6-frpv-8mvh: The management console in Symantec Endpoint Protection (SEP) 11↗2022-05-17
▶
CVEList
CVE-2012-4348: The management console in Symantec Endpoint Protection (SEP) 11↗2012-12-18
▶

📋Vendor Advisories

1
Red Hat
kernel: incomplete fix for CVE-2011-2482↗2012-01-10
▶
CVE-2012-4348 — Improper Input Validation in Symantec | cvebase