CVE-2012-4348
Summary
| CVE | CVE-2012-4348 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-12-18 20:55:01 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The management console in Symantec Endpoint Protection (SEP) 11.0 before RU7-MP3 and 12.1 before RU2, and Symantec Endpoint Protection Small Business Edition 12.x before 12.1 RU2, does not properly validate input for PHP scripts, which allows remote authenticated users to execute arbitrary code via unspecified vectors. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
AdjacentAccess Complexity
LowAuthentication
MultipleConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:A/AC:L/Au:M/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Symantec | Endpoint Protection | 11.0 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0 | ru5 | All | All |
| Application | Symantec | Endpoint Protection | 11.0 | ru6 | All | All |
| Application | Symantec | Endpoint Protection | 11.0 | ru6a | All | All |
| Application | Symantec | Endpoint Protection | 11.0 | ru6mp1 | All | All |
| Application | Symantec | Endpoint Protection | 11.0 | ru6mp2 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.1 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.1 | mp1 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.1 | mp2 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.2 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.2 | mp1 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.2 | mp2 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.3001 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.4 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.4 | mp1a | All | All |
| Application | Symantec | Endpoint Protection | 11.0.4 | mp2 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.6000 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.6100 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.6200 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.6200.754 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.6300 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.7000 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.7100 | All | All | All |
| Application | Symantec | Endpoint Protection | 12.0 | - | small_business | All |
| Application | Symantec | Endpoint Protection | 12.1 | All | All | All |
| Application | Symantec | Endpoint Protection | 12.1 | - | small_business | All |
| Application | Symantec | Endpoint Protection | 12.1.1000 | All | All | All |
| Application | Symantec | Endpoint Protection | 12.1.671 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Updates Detail | af854a3a-2127-422b-91ae-364da2661108 | www.symantec.com | |
| Symantec Endpoint Protection Input Validation Flaw Lets Remote Users Execute Arbitrary Code - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Symantec Endpoint Protection Manager CVE-2012-4348 Remote Code Execution Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.