CVE-2014-3437: High severity symantec endpoint protection vulnerability
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3437?
CVE-2014-3437 has a medium severity rating due to its potential to allow unauthorized access to sensitive information.
How do I fix CVE-2014-3437?
To fix CVE-2014-3437, upgrade Symantec Endpoint Protection Manager to version 12.1.5 or later.
What are the risks associated with CVE-2014-3437?
The risks of CVE-2014-3437 include unauthorized file access and the possibility of sending malicious requests to internal servers.
Which versions of Symantec Endpoint Protection are affected by CVE-2014-3437?
CVE-2014-3437 affects Symantec Endpoint Protection Manager versions 12.1.0 through 12.1.4.
Can CVE-2014-3437 be exploited remotely?
Yes, CVE-2014-3437 can be exploited remotely by attackers to read files on the server.