Unscored severity · published Jul 31, 2013
CVE-2013-4674
Cross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Universal Server) before 3.3.0 MP2…
–
CVSS
0.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Universal Server) before 3.3.0 MP2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted encrypted e-mail attachment.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Encryption Management Server · Symantec
through 3.3.0; 3.3.0 · source: NVD
PU
Pgp Universal Server · Symantec
3.2.0; 3.2.1; 3.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4674
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4674
osvdb.org
http://osvdb.org/95581
secunia.com
http://secunia.com/advisories/54214
www.securityfocus.com
http://www.securityfocus.com/bid/61290
www.securitytracker.com
http://www.securitytracker.com/id/1028820
Vendor Advisory
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130722_00
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/85902
More from Encryption Management Server
9.1
CVE-2015-8151
Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging console administrator access
7.8
CVE-2015-8150
Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file
7.5
CVE-2018-5243
The Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of service (DoS) exploit
7.5
CVE-2015-8149
The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to cause a denial of service (heap memory corruption and service outage)…
7.5
CVE-2015-8148
The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about administrator accounts via a…