SQL Injection in Symantec Endpoint Protection
CVE-2014-9229
Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow remote authenticated users to execute arbitrary SQL commands by leveraging the Limited Administrator role.
Vulnerability class: SQL Injection
EPSS: 0.017 (75.2th percentile) — read the EPSS interpretation.
Affected products
- Symantec Endpoint_protection
- N/a — versions n/a
Weakness classification (CWE)
References
- secure@symantec.com (x_refsource_CONFIRM, Vendor Advisory)
- secure@symantec.com (vdb-entry, x_refsource_BID)
- secure@symantec.com (vdb-entry, x_refsource_SECTRACK)