Symantec Endpoint Detection and Response Console contains a stored or reflected Cross‑Site Scripting flaw that permits injection of arbitrary JavaScript. This script would execute in the browser context of another authenticated user, allowing an attacker to gain access to administrative functions or confidential data that are normally protected. The weakness is formally classified as CWE‑79.

Broadcom Symantec Endpoint Detection and Response, versions earlier than 4.13 are affected. No additional version details are supplied.

The CVSS score is 5.4, indicating moderate severity, and the EPSS score is less than 1%, suggesting low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be the web console, where an attacker can supply malicious input that is subsequently rendered in other users’ browsers. Successful exploitation would provide unauthorized functionality or information access.