Vulnerability Details : CVE-2011-0551
Cross-site request forgery (CSRF) vulnerability in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.6300 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.
Vulnerability category: Cross-site request forgery (CSRF)
Products affected by CVE-2011-0551
- cpe:2.3:a:symantec:endpoint_protection:11.0.6200.754:*:*:*:*:*:*:*
- cpe:2.3:a:symantec:endpoint_protection:11.0.6000:*:*:*:*:*:*:*
- cpe:2.3:a:symantec:endpoint_protection:11.0.6100:*:*:*:*:*:*:*
- cpe:2.3:a:symantec:endpoint_protection:11.0.6300:*:*:*:*:*:*:*
- cpe:2.3:a:symantec:endpoint_protection:11.0.6200:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2011-0551
0.26%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 47 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2011-0551
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2011-0551
-
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-0551
-
http://securitytracker.com/id?1025919
Symantec Endpoint Protection Manager Input Validation Hole Permits Cross-Site Scripting and Cross-Site Request Forgery Attacks - SecurityTracker
-
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110810_00
Symantec Endpoint Protection Manager Cross-Site Request Forgery and Cross-Site Scripting
-
http://www.securityfocus.com/bid/49101
Symantec Endpoint Protection CVE-2011-0551 Cross Site Request Forgery Vulnerability
-
http://secunia.com/advisories/43662
Sign inVendor Advisory
-
http://www.osvdb.org/74467
404 Not Found
Jump to