CVE-2013-5015: SQL Injection

Published Feb 14, 2014

Updated

SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Affected Software

6 affected components

Symantec Endpoint Protection Manager=11.0

Symantec Endpoint Protection Manager=12.1.0

Symantec Endpoint Protection Manager=12.1.1

Symantec Endpoint Protection Manager=12.1.2

Symantec Endpoint Protection Manager=12.1.3

Symantec Protection Center=12.0

Event History

Feb 14, 2014

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-5015?

CVE-2013-5015 is considered a high-severity vulnerability due to its potential for remote SQL injection attacks.

How do I fix CVE-2013-5015?

To fix CVE-2013-5015, upgrade your Symantec Endpoint Protection Manager to version 11.0.7405.1424 or later, or version 12.1.4023.4080 or later.

Who is affected by CVE-2013-5015?

CVE-2013-5015 affects users of Symantec Endpoint Protection Manager versions prior to 11.0.7405.1424 and 12.1.4023.4080, as well as those using Symantec Protection Center Small Business Edition 12.x.

What types of attacks can be executed using CVE-2013-5015?

CVE-2013-5015 allows remote authenticated users to execute arbitrary SQL commands, potentially compromising the database.

What are the affected software versions for CVE-2013-5015?

The affected software versions for CVE-2013-5015 include Symantec Endpoint Protection Manager 11.0 and 12.1 versions prior to their respective patches.