CVE-2015-8799

Severity: high (CVSS 7.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-08 · updated 2026-06-17
Weakness: CWE-22

Description

Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to write update-package data to arbitrary agent locations via unspecified vectors.

Affected products

Symantec Critical System Protection (CSP): through 5.2.9
Symantec Data Loss Prevention: from 6.0.0 before 6.5.0; 6.5.0, 6.6.0 — fixed in 6.5.0
Broadcom Symantec Data Center Security Server And Agents: 6.6.0
Broadcom Symantec Embedded Security Critical System Protection: through 1.0
Broadcom Symantec Embedded Security Critical System Protection For Controllers And Devices: 6.5.0

How to fix

Upgrade to a fixed version: Symantec Data Loss Prevention 6.5.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2015-8799 or the next vulnerability affects your stack