Vulnerability in Symantec Encryption Management Server

CVE-2014-1643

The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL.

EPSS: 0.007 (51.1th percentile) — read the EPSS interpretation.

Affected products

Symantec Encryption_management_server — versions 3.3.0
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

secure@symantec.com (vdb-entry, x_refsource_SECTRACK)
secure@symantec.com (x_refsource_CONFIRM, Vendor Advisory)
secure@symantec.com (vdb-entry, x_refsource_BID)
secure@symantec.com (vdb-entry, x_refsource_XF)