CVE-2019-19547 PoC — Symantec Endpoint Detection and Response 跨站脚本漏洞

Source

https://github.com/nasbench/CVE-2019-19547

Associated Vulnerability

Title:Symantec Endpoint Detection and Response 跨站脚本漏洞 (CVE-2019-19547)
Description:Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) issue. XSS is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. An XSS vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.

Description

CVE-2019-19547 POC

Readme

# CVE-2019-19547
CVE-2019-19547 POC

Symantec EDR on-prem version prior to "4.3.0" is vulnerable to an unauthenticated reflected XSS via the following URL:

```
https://@IP_EDR/r3_epmp_i/v1/dx/log<insert_xss_payload_here>
```

### Reference 
* https://support.broadcom.com/security-advisory/content/security-advisories/Symantec-Endpoint-Detection-and-Response-XSS/SYMSA1502

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!