CVE-2009-1432 json
Symantec Reporting Server, as used in Symantec AntiVirus (SAV) Corporate Edition 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2, Symantec Cl…
published 2009-04-30 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-1430
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.2%
- EPSS 4.2% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
Symantec Reporting Server, as used in Symantec AntiVirus (SAV) Corporate Edition 10.1 before 10.1 MR8 and 10.2 before 10.2 MR2, Symantec Client Security (SCS) before 3.1 MR8, and the Symantec Endpoint Protection Manager (SEPM) component in Symantec Endpoint Protection (SEP) before 11.0 MR2, allows remote attackers to inject arbitrary text into the login screen, and possibly conduct phishing attacks, via vectors involving a URL that is not properly handled.
Exploit prediction
4.23% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
symantec.com
/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=2009
vendor-advisory
-
vupen.com
/english/advisories/2009/1204
vdb-entry, third-party-advisory
-
securitytracker.com
/id?1022137
vdb-entry, third-party-advisory
-
secunia.com
/advisories/34856
third-party-advisory
-
securitytracker.com
/id?1022138
vdb-entry, third-party-advisory
-
secunia.com
/advisories/34935
third-party-advisory
-
securitytracker.com
/id?1022136
vdb-entry, third-party-advisory
-
vupen.com
/english/advisories/2009/1202
vdb-entry, third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/50172
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/34668
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2009-1432
- NVD CVE-2009-1432
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.