CVE-2014-3438

Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published: Nov 7, 2014
Updated: Apr 13, 2023
CVE: CVE-2014-3438
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
symantec / endpoint_protection_manager	12.1.0	12.1.0.x
symantec / endpoint_protection_manager	12.1.1	12.1.1.x
symantec / endpoint_protection_manager	12.1.3	12.1.3.x
symantec / endpoint_protection_manager	-	12.1.4.x
symantec / endpoint_protection_manager	12.1.2	12.1.2.x

http://seclists.org/fulldisclosure/2014/Nov/7
http://www.securityfocus.com/archive/1/533918/100/0/threaded
http://www.securityfocus.com/bid/70844
http://www.securitytracker.com/id/1031176
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141105_00
https://exchange.xforce.ibmcloud.com/vulnerabilities/98526

Vulnerability Database

289,784

CVE-2014-3438