CVE-2024-36456

CWE-94 — Code Injection3 documents3 sources

Severity

9.4CRITICAL

EPSS

1.3%

top 20.18%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Broadcom Symantec Privileged Access Management

Timeline

PublishedJul 15

Description

This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgrade file.

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected Packages1 packages

▶CVEListV5broadcom/symantec_privileged_access_management3.4.6, 4.1.0 - 4.1.7+1

🔴Vulnerability Details

CVEList

Symantec Privileged Access Manager Remote Command Execution vulnerability↗2024-07-15

▶

GHSA

GHSA-jx6c-5cpp-f93r: This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted↗2024-07-15

▶