CVE-2020-5833: 
Symantec Endpoint Management vulnerability analysis and mitigation

Symantec Endpoint Protection Manager (SEPM), prior to version 14.3, contains an out-of-bounds vulnerability identified as CVE-2020-5833. This vulnerability was disclosed on May 11, 2020, and affects the memory handling capabilities of the application (Broadcom Advisory, NVD).

The vulnerability is classified as an out-of-bounds read issue (CWE-125) that allows an application to read memory outside the bounds of allocated program memory. The severity is rated as Low with a CVSS v3.1 Base Score of 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), indicating local access is required and the primary impact is on confidentiality (NVD).

The vulnerability primarily affects the confidentiality of data, as it allows unauthorized reading of memory outside allocated bounds. However, the overall impact is considered low due to the local access requirement and limited scope of the vulnerability (Broadcom Advisory).

The vulnerability has been patched in Symantec Endpoint Protection Manager version 14.3. Organizations are advised to upgrade to this version to remediate the issue. Additionally, Symantec recommends restricting access to administrative systems to authorized privileged users and following the principle of least privilege (Broadcom Advisory).

The vulnerability was discovered and reported by security researcher Z0mb1E. Symantec has implemented additional detections and protections and continues to monitor for potential exploitation attempts (Broadcom Advisory).