HOMEVULNERABILITIESCVE-2013-5008
MEDIUM

CVE-2013-5008

CWE-200Published: October 10, 2013· Updated: Jun 16, 2026

4.6
CVSS v3.1

Official Description

The agent and task-agent components in Symantec Management Platform 7.0 and 7.1 before 7.1 SP2 Mp1.1v7 rollup, as used in certain Altiris products, use the same registry-entry encryption key across different customers' installations, which makes it easier for local users to obtain sensitive information about package-server access, or cause a denial of service, by leveraging knowledge of this key.

NVD Source

Technical Analysis

CVE-2013-5008 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityLow
Privileges Req.
User Interaction
Scope
Impact
ConfidentialityP
IntegrityP
AvailabilityP
AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected Vendors & Products

symantec1 product(s)
management platform
Source: NVD CPE · 2 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttp://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20131008_00
PATCHhttp://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20131008_00

All References (4)

→
http://www.securityfocus.com/bid/62757
→
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20131008_00Patch · Vendor Advisory
→
http://www.securityfocus.com/bid/62757
→
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20131008_00Patch · Vendor Advisory

Quick Facts

CVE IDCVE-2013-5008
CVSS Score4.6 / 10
SeverityMEDIUM
WeaknessCWE-200
CISA KEVNo
Affected1 vendor(s)
PublishedOct 10, 2013

Related CVEs (CWE-200)

CVE-2013-0693
10.0
CVE-2017-2320
10.0
CVE-2025-53624
10.0
CVE-2010-1230
10.0
CVE-2015-2897
10.0
CVE-2025-61481
10.0

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2013-5008 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2013-5008·NVD