CVE-2020-5835 Race condition in Symantec Endpoint Protection Manager

What is CVE-2020-5835?

CVE-2020-5835 is a high-severity vulnerability in Symantec Endpoint Protection Manager, published on 11 May 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Symantec Endpoint Protection Manager, prior to 14.3, has a race condition in client remote deployment which may result in an elevation of privilege on the remote machine.

Weakness: CWE-362

Which versions are affected by CVE-2020-5835?

It affects 1 product.

Products include Symantec Endpoint Protection Manager.

How do I fix CVE-2020-5835?

No fix has been published for CVE-2020-5835 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-5835 being exploited?

There is no known exploitation of CVE-2020-5835 in the wild and no public exploit code.

Other vulnerabilities in Symantec Endpoint Protection Manager

• CVE-2016-3648 Security feature bypass in n/a High 8.8
• CVE-2016-3650 Information disclosure in n/a High 8.8
• CVE-2015-8153 SQL injection in n/a High 8.8
• CVE-2015-8154 Privilege escalation in n/a High 8.8
• CVE-2015-6555 Code injection in n/a High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6pqp-3jf8-m667.