CVE-2014-1643: Medium severity Symantec Encryption Management Server vulnerability
Published Feb 7, 2014
·Updated
The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL.
Affected Software
4 affected components
Symantec Encryption Management Server<=3.3.1
Symantec Encryption Management Server=3.3.0
Symantec Encryption Management Server=3.3.0-mp1
Symantec Encryption Management Server=3.3.0-mp2
Event History
Feb 7, 2014
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Data Sourced
via NVD·04:52 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-1643?
CVE-2014-1643 is classified as a high severity vulnerability.
2
How do I fix CVE-2014-1643?
To fix CVE-2014-1643, upgrade your Symantec Encryption Management Server to version 3.3.2 or later.
3
What type of attack does CVE-2014-1643 allow?
CVE-2014-1643 allows authenticated remote users to access stored outbound email messages of other users.
4
What versions of Symantec Encryption Management Server are affected by CVE-2014-1643?
CVE-2014-1643 affects versions 3.3.1 and earlier of Symantec Encryption Management Server.
5
Can CVE-2014-1643 be exploited by unauthenticated users?
CVE-2014-1643 cannot be exploited by unauthenticated users as it requires valid authentication credentials.