CVE-2013-4674: XSS
First published: Wed Jul 31 2013(Updated: )
Cross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Universal Server) before 3.3.0 MP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted encrypted e-mail attachment.
Credit: secure@symantec.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Symantec Encryption Management Server | <=3.3.0 | |
| Symantec Encryption Management Server | =3.3.0 | |
| Symantec PGP Universal Server | =3.2.0 | |
| Symantec PGP Universal Server | =3.2.1 | |
| Symantec PGP Universal Server | =3.2.1-mp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://osvdb.org/95581
- http://secunia.com/advisories/54214
- http://www.securityfocus.com/bid/61290
- http://www.securitytracker.com/id/1028820
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130722_00
- https://exchange.xforce.ibmcloud.com/vulnerabilities/85902
Frequently Asked Questions
What is the severity of CVE-2013-4674?
CVE-2013-4674 is classified as a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2013-4674?
To fix CVE-2013-4674, you should upgrade to Symantec Encryption Management Server version 3.3.0 MP2 or later.
What type of vulnerability is CVE-2013-4674?
CVE-2013-4674 is a cross-site scripting (XSS) vulnerability affecting the Web Email Protection component.
Who is affected by CVE-2013-4674?
CVE-2013-4674 affects users of Symantec Encryption Management Server and Symantec PGP Universal Server versions prior to 3.3.0 MP2.
Can CVE-2013-4674 be exploited remotely?
Yes, CVE-2013-4674 can be exploited by remote authenticated users to inject arbitrary web scripts or HTML.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/symantec
- canonical/symantec encryption management server
- version/symantec encryption management server/3.3.0
- canonical/symantec pgp universal server
- version/symantec pgp universal server/3.2.0
- version/symantec pgp universal server/3.2.1
- version/symantec pgp universal server/3.2.1-mp2