XML External Entity Vulnerability in Symantec Endpoint Protection and Protection Center

CVE-2013-5014

Summary

The management console in Symantec Endpoint Protection Manager versions earlier than 11.0.7405.1424 and 12.1 versions before 12.1.4023.4080, as well as in Symantec Protection Center Small Business Edition versions prior to 12.1.4023.4080, is susceptible to XML External Entity (XXE) attacks. This flaw enables remote attackers to exploit the management console, allowing them to read arbitrary files on the server. The vulnerability arises from processing XML data that includes an external entity declaration along with an entity reference.

References