CVE-2011-0550: XSS
First published: Mon Aug 15 2011(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.6300 allow remote attackers to inject arbitrary web script or HTML via (1) the token parameter to portal/Help.jsp or (2) the URI in a console/apps/sepm request.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Symantec Endpoint Protection | =11.0.6300 | |
| Symantec Endpoint Protection | =11.0.6200.754 | |
| Symantec Endpoint Protection | =11.0.6100 | |
| Symantec Endpoint Protection | =11.0.6000 | |
| Symantec Endpoint Protection | =11.0.6200 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://securitytracker.com/id?1025919
- http://secunia.com/advisories/43662
- http://www.osvdb.org/74466
- http://www.securityfocus.com/bid/48231
- http://www.osvdb.org/74465
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110810_00
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69136
Frequently Asked Questions
What is the nature of CVE-2011-0550?
CVE-2011-0550 is a vulnerability that allows remote attackers to execute cross-site scripting (XSS) attacks via the Web Interface of Symantec Endpoint Protection.
Which versions of Symantec Endpoint Protection are affected by CVE-2011-0550?
CVE-2011-0550 affects Symantec Endpoint Protection versions 11.0.6000 through 11.0.6300.
What can attackers achieve using CVE-2011-0550?
Attackers can inject arbitrary web script or HTML into the application, compromising its security.
How can I mitigate the risks associated with CVE-2011-0550?
To mitigate the risks, it is recommended to update to a fixed version of Symantec Endpoint Protection or apply relevant security patches.
Is user interaction required to exploit CVE-2011-0550?
Exploiting CVE-2011-0550 typically requires no user interaction, as it can be executed by sending crafted requests to the vulnerable web interface.
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/symantec
- canonical/symantec endpoint protection
- version/symantec endpoint protection/11.0.6300
- version/symantec endpoint protection/11.0.6200.754
- version/symantec endpoint protection/11.0.6100
- version/symantec endpoint protection/11.0.6000
- version/symantec endpoint protection/11.0.6200