CVE-2013-5014: Symantec Endpoint Protection Manager XXE allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable file disclosure on a central security management server, with very high EPSS and public exploit references, though no confirmed in-the-wild use.

What it is

The SEPM management console parses XML containing external entity declarations and entity references without disabling them, an XML External Entity (XXE) flaw. It affects SEPM 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, plus Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080. Because the console is the central management component for endpoint agents, a file-read flaw there exposes configuration and credential material.

Impact

A remote attacker can read arbitrary files on the SEPM host, which may include configuration data and credentials used to manage endpoints. The CVSS 2.0 vector also scores partial integrity and availability impact, but the description only confirms file disclosure.

Attack surface

Reachable over the network via the management console's XML handling (AV:N, AC:L, Au:N), so no authentication and no user interaction are required per the vector. The flaw is in server-side XML parsing of attacker-supplied data.

Exploitation

Not listed in CISA KEV, but EPSS is 0.67573 (99.3rd percentile), indicating high predicted exploitation activity. Two Exploit-DB entries and a third-party advisory are referenced, so public exploit code likely exists, though the reference tags do not explicitly label it as such.

What to do

• Upgrade SEPM to 11.0.7405.1424 or later, or 12.1.4023.4080 or later, and Protection Center Small Business Edition to 12.1.4023.4080 or later.
• Restrict network access to the SEPM management console to trusted administrative networks only.
• Disable external entity resolution in any XML parser handling console input where the product allows configuration.
• Monitor vendor advisory suid=20140213_00 for updated guidance and any follow-up fixes.

Detection

• Review SEPM console and web server logs for XML requests containing DOCTYPE or ENTITY declarations.
• Alert on outbound or local file access patterns from the SEPM process that read unexpected files.
• Hunt for requests to the management console from untrusted source IPs or non-administrative hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.