← Vulnerability feed

Vulnerability record · CVE-2014-7288 · published 1 February 2015

CVE-2014-7288: Symantec encryption management server permissions and access controls vulnerability

Symantec · Encryption Management Server

Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands via a crafted command line in a database-backup restore action.

9.0 CVSS 2.0 High EPSS 8.1% · top 5.4% CWE-264 · Permissions and access controls
9.0CVSS 2.0 base score
8.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands via a crafted command line in a database-backup restore action.

AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.exploit-db.com/exploits/35949
http://www.osvdb.org/117766
http://www.securityfocus.com/bid/72308
http://www.securitytracker.com/id/1031673
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100763
http://www.exploit-db.com/exploits/35949
http://www.osvdb.org/117766
http://www.securityfocus.com/bid/72308
http://www.securitytracker.com/id/1031673
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/100763

Track CVE-2014-7288 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2015-8151Symantec encryption management server os command injection vulnerabilitySymantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging conso…EPSS 1.6%7.8CVE-2015-8150Symantec encryption management server permissions and access controls vulnerabilitySymantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file.EPSS 0.28%7.5CVE-2018-5243Symantec encryption management server uncontrolled resource consumption vulnerabilityThe Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of service (DoS) exploit. A DoS …EPSS 1.8%7.5CVE-2015-8148Symantec encryption management server information exposure vulnerabilityThe LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about admi…EPSS 1.6%7.5CVE-2015-8149Symantec encryption management server memory buffer overflow vulnerabilityThe LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to cause a denial of service (heap memory …EPSS 1.7%5.0CVE-2014-7287Symantec encryption management server injection vulnerabilityThe key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger un…EPSS 1.1%4.3CVE-2013-4674Symantec encryption management server cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Univer…EPSS 0.89%4.0CVE-2014-1643Symantec encryption management server permissions and access controls vulnerabilityThe Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users…EPSS 0.75%

Source: NIST National Vulnerability Database (record CVE-2014-7288), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.