Privilege Escalation in Symantec Endpoint Protection and Symantec Endpoint Protection Small Business Edition
CVE-2019-12750

7.8HIGH

Key Information:

Vendor
Symantec
Status
Symantec Endpoint Protection, Symantec Endpoint Protection Small Business Edition
Vendor
CVE Published:
31 July 2019

Badges

👾 Exploit Exists🟡 Public PoC

Summary

Symantec Endpoint Protection and its Small Business Edition versions are vulnerable to a privilege escalation issue. This vulnerability allows attackers to exploit the software to gain elevated access to restricted resources, which are typically secured against unauthorized application or user access. Proper system configurations and updates are crucial to mitigate this risk and protect sensitive information.

Affected Version(s)

Symantec Endpoint Protection, Symantec Endpoint Protection Small Business Edition Prior to 14.2 RU1 & 12.1 RU6 MP10, Prior to 12.1 RU6 MP10c (12.1.7491.7002)

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2019-12750
Created by v-p-b

References

https://support.symantec.com/us/en/article.SYMSA1487.html
x_refsource_MISC
http://packetstormsecurity.com/files/155581/Symantec-Endp...
x_refsource_MISC
http://seclists.org/fulldisclosure/2019/Dec/11
mailing-listx_refsource_FULLDISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.