CVE-2013-5009
Summary
| CVE | CVE-2013-5009 |
|---|---|
| State | PUBLISHED |
| Assigner | symantec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-01-10 16:47:05 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The Management Console in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoint Protection Small Business Edition 12.x before 12.1.2 RU2 does not properly perform authentication, which allows remote authenticated users to gain privileges by leveraging access to a limited-admin account. |
Risk And Classification
Primary CVSS: v2.0 7.4 from [email protected]
AV:A/AC:M/Au:S/C:C/I:C/A:C
EPSS: 0.003020000 probability, percentile 0.535120000 (date 2026-05-01)
Problem Types: CWE-287 | n/a
CVSS v2.0 Breakdown
Access Vector
AdjacentAccess Complexity
MediumAuthentication
SingleConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:A/AC:M/Au:S/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Symantec | Endpoint Protection | 11.0 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0 | ru5 | All | All |
| Application | Symantec | Endpoint Protection | 11.0 | ru6 | All | All |
| Application | Symantec | Endpoint Protection | 11.0 | ru6a | All | All |
| Application | Symantec | Endpoint Protection | 11.0 | ru6mp1 | All | All |
| Application | Symantec | Endpoint Protection | 11.0 | ru6mp2 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.1 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.1 | mp1 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.1 | mp2 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.2 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.2 | mp1 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.2 | mp2 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.3001 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.4 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.4 | mp1a | All | All |
| Application | Symantec | Endpoint Protection | 11.0.4 | mp2 | All | All |
| Application | Symantec | Endpoint Protection | 11.0.6000 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.6100 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.6200 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.6200.754 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.6300 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.7000 | All | All | All |
| Application | Symantec | Endpoint Protection | 11.0.7100 | All | All | All |
| Application | Symantec | Endpoint Protection | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Symantec Endpoint Protection CVE-2013-5009 Remote Privilege Escalation Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Security Advisories Relating to Symantec Products - Symantec Endpoint Protection Privilege Assumption, Policy Bypass, Local Elevation of Privilege - 2014-01-09T11:22:55 PST | Symantec | af854a3a-2127-422b-91ae-364da2661108 | www.symantec.com | Vendor Advisory |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.