Medium severity · published Mar 26, 2018
CVE-2017-15534
The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit
6.7
CVSS
0.4%
EPSS
No
On KEV
Description
The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the user to kill the app to prevent it from locking the device, thereby allowing the individual to gain device access.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Norton App Lock · Symantec
before 1.3.0.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15534
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15534
Third Party Advisory
http://www.securityfocus.com/bid/103377
Mitigation
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20180326_00
More from Norton App Lock
7.1
CVE-2016-6591
A security bypass vulnerability exists in Symantec Norton App Lock 1.0.3.186 and earlier if application pinning is enabled, which could let a local malicious user bypass security…
6.2
CVE-2018-18363
Norton App Lock prior to 1.4.0.445 can be susceptible to a bypass exploit
6.2
CVE-2018-5239
Norton App Lock prior to v1.3.0.332 can be susceptible to a bypass exploit
6.2
CVE-2018-5242
Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit
5.6
CVE-2019-18373
Norton App Lock, prior to 1.4.0.503, may be susceptible to a bypass exploit