VulnerabilityModified

CVE-2015-8799

HIGH 7.6EPSS 5.26%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (5.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to write update-package data to arbitrary agent locations via unspecified vectors.

CVSS 3.1: 7.6 HIGHCVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS: 5.26% probability · 92th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: broadcom/symantec critical system protection · broadcom/symantec data center security server · broadcom/symantec data center security server and agents · broadcom/symantec embedded security critical system protection · broadcom/symantec embedded security critical system protection for controllers and devices
Source: secure@symantec.com

References

http://www.securityfocus.com/bid/90885Third Party Advisory, VDB Entry
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160607_00Vendor Advisory
http://www.securityfocus.com/bid/90885Third Party Advisory, VDB Entry
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160607_00Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.