← Vulnerability feed

Vulnerability record · CVE-2014-7287 · published 1 February 2015

CVE-2014-7287: Symantec encryption management server injection vulnerability

Symantec · Encryption Management Server

The key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message, as demonstrated by the outbound Subject header.

5.0 CVSS 2.0 Medium EPSS 1.1% · top 35.4% CWE-74 · Injection
5.0CVSS 2.0 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

The key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message, as demonstrated by the outbound Subject header.

AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/72307 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1031673
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100762
http://www.securityfocus.com/bid/72307 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1031673
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100762

Track CVE-2014-7287 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2015-8151Symantec encryption management server os command injection vulnerabilitySymantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging conso…EPSS 1.6%9.0CVE-2014-7288Symantec encryption management server permissions and access controls vulnerabilitySymantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell …EPSS 8.1%7.8CVE-2015-8150Symantec encryption management server permissions and access controls vulnerabilitySymantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file.EPSS 0.28%7.5CVE-2018-5243Symantec encryption management server uncontrolled resource consumption vulnerabilityThe Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of service (DoS) exploit. A DoS …EPSS 1.8%7.5CVE-2015-8148Symantec encryption management server information exposure vulnerabilityThe LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about admi…EPSS 1.6%7.5CVE-2015-8149Symantec encryption management server memory buffer overflow vulnerabilityThe LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to cause a denial of service (heap memory …EPSS 1.7%4.3CVE-2013-4674Symantec encryption management server cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Univer…EPSS 0.89%4.0CVE-2014-1643Symantec encryption management server permissions and access controls vulnerabilityThe Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users…EPSS 0.75%

Source: NIST National Vulnerability Database (record CVE-2014-7287), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.