CVE-2016-3647: SSRF
Published Jun 30, 2016
·Updated
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request.
Affected Software
1 affected component
Symantec Endpoint Protection Manager<=12.1.6
Event History
Jun 30, 2016
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-3647?
CVE-2016-3647 has a moderate severity rating, as it allows remote authenticated users to conduct SSRF attacks.
2
How do I fix CVE-2016-3647?
To fix CVE-2016-3647, ensure you update Symantec Endpoint Protection Manager to version 12.1 RU6 MP5 or later.
3
Who is affected by CVE-2016-3647?
CVE-2016-3647 affects Symantec Endpoint Protection Manager versions prior to RU6 MP5.
4
What type of attacks can be executed using CVE-2016-3647?
CVE-2016-3647 can be exploited to perform server-side request forgery (SSRF) attacks.
5
What implications does CVE-2016-3647 have for network security?
CVE-2016-3647 can lead to unauthorized access to intranet hosts and potentially expose sensitive internal resources.