SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2013-5015

SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows…

MEDIUM 6.5EPSS 28.8%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 28.8%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

CVSS 2.0
6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS
28.76% probability · 98th percentile
CISA KEV
Not listed
Weakness
CWE-89
Affected
symantec/endpoint protection manager · symantec/protection center
Source
secure@symantec.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.