CVE-2007-3022
Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition (SAV CE) 10.1 and later, displays the password hash for a user after a failed login…
Does this matter?
Lower severity and a low EPSS score (2.05%). Track it; it rarely justifies an emergency change on its own.
Description
Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition (SAV CE) 10.1 and later, displays the password hash for a user after a failed login attempt, which makes it easier for remote attackers to conduct brute force attacks.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 2.05% probability · 80th percentile
- CISA KEV
- Not listed
- Affected
- symantec/client security · symantec/norton antivirus · symantec/reporting server
- Source
- cve@mitre.org
References
- http://osvdb.org/36108
- http://secunia.com/advisories/25543
- http://www.securityfocus.com/bid/24312
- http://www.securitytracker.com/id?1018196
- http://www.symantec.com/avcenter/security/Content/2007.06.05.htmlPatch
- http://www.vupen.com/english/advisories/2007/2074
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34740
- http://osvdb.org/36108
- http://secunia.com/advisories/25543
- http://www.securityfocus.com/bid/24312
- http://www.securitytracker.com/id?1018196
- http://www.symantec.com/avcenter/security/Content/2007.06.05.htmlPatch
- http://www.vupen.com/english/advisories/2007/2074
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34740
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.