CVE-2014-9230: Cross-site scripting (XSS) vulnerability in the administration console in the Enforce Server in Symantec Da...

Security readout for executives and security teams

CVE-2014-9230 is a cross-site scripting issue in the Symantec Data Loss Prevention Enforce Server administration console before version 12.5.2. An attacker could inject script or HTML through unspecified vectors. The public record does not provide CVSS, severity, or detailed attack conditions. Exposure is limited to environments running Symantec Data Loss Prevention Enforce Server versions earlier than 12.5.2. Risk increases if the administration console is reachable by untrusted users or broadly accessible inside the network. Treat this as a targeted hygiene item for any legacy Symantec DLP deployment. It is not KEV-listed in the supplied data, but an admin-console XSS can become material if administrators use exposed or poorly restricted consoles. Mitigation focus: Identify all Symantec DLP Enforce Server instances and versions.; Upgrade systems running versions before 12.5.2 using vendor guidance.; Restrict administration console access to trusted administrative networks..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.