« Volver al listado

CVE-2019-12759

Estado: ModificadaAlta (7.8)—

Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Symantec — Endpoint Protection ManagerSymantec — Mail Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-12759",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@symantec.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Symantec Endpoint Protection Manager (SEPM), Symantec Mail Security for MS Exchange (SMSMSE)",
          "versions": [
            {
              "status": "affected",
              "version": "prior to versions 14.2 RU2, prior to 7.5.x"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-11-15T18:15:10.907",
  "references": [
    {
      "url": "https://support.symantec.com/us/en/article.SYMSA1488.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "https://support.symantec.com/us/en/article.SYMSA1488.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user."
    },
    {
      "lang": "es",
      "value": "Symantec Endpoint Protection Manager (SEPM) y Symantec Mail Security for MS Exchange (SMSMSE), versiones anteriores a las versiones 14.2 RU2 y 7.5.x respectivamente, pueden ser susceptibles a una vulnerabilidad de escalada de privilegios, que es un tipo de problema por el cual un atacante puede intentar comprometer la aplicación de software para conseguir un acceso elevado a recursos que normalmente están protegidos de una aplicación o un usuario."
    }
  ],
  "lastModified": "2026-06-17T02:15:23.690",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:symantec:endpoint_protection_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5A27B5A0-A047-4AC5-9CE1-7808641BCCE5",
              "versionEndIncluding": "14.2"
            },
            {
              "criteria": "cpe:2.3:a:symantec:endpoint_protection_manager:14.2:ru1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C72A5FE1-0382-46BC-9E8F-B338443F89AA"
            },
            {
              "criteria": "cpe:2.3:a:symantec:mail_security:*:*:*:*:*:microsoft_exchange:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D14A6653-25F7-44AF-A7E3-37842B9D1B8D",
              "versionEndExcluding": "7.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@symantec.com"
}