Vulnerability Name: | CVE-2016-3647 (CCN-114600) | ||||||||||||
Assigned: | 2016-06-28 | ||||||||||||
Published: | 2016-06-28 | ||||||||||||
Updated: | 2017-09-01 | ||||||||||||
Summary: | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request. <a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918: Server-Side Request Forgery (SSRF)</a> | ||||||||||||
CVSS v3 Severity: | 7.7 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) 6.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C)
4.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C)
| ||||||||||||
CVSS v2 Severity: | 4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
| ||||||||||||
Vulnerability Type: | CWE-Other | ||||||||||||
Vulnerability Consequences: | Gain Access | ||||||||||||
References: | Source: MITRE Type: CNA CVE-2016-3647 Source: BID Type: UNKNOWN 91433 Source: CCN Type: BID-91433 Symantec Endpoint Protection Manager and Client CVE-2016-3647 Security Bypass Vulnerability Source: SECTRACK Type: UNKNOWN 1036196 Source: XF Type: UNKNOWN symantec-cve20163647-ssrf(114600) Source: CCN Type: Symantec Security Advisory SYM16-011 Symantec Endpoint Protection Manager Multiple Security Issues Source: CONFIRM Type: Vendor Advisory https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01 | ||||||||||||
Vulnerable Configuration: | Configuration 1: Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
BACK |