CVE-2018-12237

Severity: high (CVSS 7.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-24 · updated 2026-06-17
Weakness: CWE-78

Description

The Symantec Reporter CLI 10.1 prior to 10.1.5.6 and 10.2 prior to 10.2.1.8 is susceptible to an OS command injection vulnerability. An authenticated malicious administrator with Enable mode access can execute arbitrary OS commands with elevated system privileges.

Affected products

Symantec Corporation Symantec Reporter: from 10.1 before 10.1.5.6; from 10.2 before 10.2.1.8 — fixed in 10.1.5.6, 10.2.1.8

How to fix

Upgrade to a fixed version: Symantec Corporation Symantec Reporter 10.1.5.6, 10.2.1.8. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/106518
https://support.symantec.com/en_US/article.SYMSA1465.html
http://www.securityfocus.com/bid/106518
https://support.symantec.com/en_US/article.SYMSA1465.html

Get alerted when CVE-2018-12237 or the next vulnerability affects your stack