PT-2019-8878 · Symantec · Symantec Reporter Cli

Published 2019-01-24 · Updated 2019-02-11 · CVE-2018-12237

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symantec Reporter CLI versions 10.1 prior to 10.1.5.6 Symantec Reporter CLI versions 10.2 prior to 10.2.1.8

Description The issue allows an authenticated malicious administrator with Enable mode access to execute arbitrary OS commands with elevated system privileges due to an OS command injection vulnerability.

Recommendations For Symantec Reporter CLI versions 10.1 prior to 10.1.5.6, update to version 10.1.5.6 or later. For Symantec Reporter CLI versions 10.2 prior to 10.2.1.8, update to version 10.2.1.8 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-12237

Affected Products

Symantec Reporter Cli

References · 4

• https://osv.dev/vulnerability/CVE-2018-12237 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12237 · Security Note
• https://support.symantec.com/en_US/article.SYMSA1465.html · Vendor Advisory
• http://securityfocus.com/bid/106518 · Note