Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2014-3438 — Cross-site Scripting in Endpoint Protection Manager

CWE-79 — Cross-site Scripting5 documents5 sources

Severity

4.3MEDIUMNVD

EPSS

16.2%

top 5.18%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Symantec Endpoint Protection Manager

Timeline

PublishedNov 7

Latest updateMay 14

Description

Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDsymantec/endpoint_protection_manager12.1.4+4

🔴Vulnerability Details

GHSA

GHSA-9mwq-hjj7-fhx6: Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager (SEPM) 12↗2022-05-14

▶

CVEList

CVE-2014-3438: Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager (SEPM) 12↗2014-11-07

▶

💥Exploits & PoCs

Exploit-DB

Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities↗2014-11-06

▶

💬Community

Bugzilla

CVE-2014-9679 cups: cupsRasterReadPixels buffer overflow↗2015-02-11

▶