#VU52376 OS Command Injection in Symantec Security Analytics - CVE-2021-30642

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU52376

#VU52376 OS Command Injection in Symantec Security Analytics - CVE-2021-30642

Published: April 20, 2021


Vulnerability identifier: #VU52376
Vulnerability risk: Critical
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Red
CVE-ID: CVE-2021-30642
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Symantec Security Analytics
Software vendor:
Broadcom

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the Symantec Security Analytics web UI. A remote unauthenticated attacker can send specially crafted request to the application and execute arbitrary OS commands on the target system with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install updates from vendor's website.

External links