What is the CVSS score of CVE-2012-4736?

CVE-2012-4736 has a CVSS 2.0 base score of 3.3 (Low). CVSS vector: AV:L/AC:M/Au:N/C:P/I:P/A:N. EPSS exploitation probability: 0.1%.

Safeguard Enterprise CVE-2012-4736

LOW

Permissions, Privileges, and Access Controls (CWE-264)

2012-08-29 cve@mitre.org

Privilege Escalation Safeguard Enterprise

3.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:M/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:M/Au:N/C:P/I:P/A:N

Attack Vector

Local

Attack Complexity

Confidentiality

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Aug 29, 2012 - 22:55 cve.org

LOW 3.3

DescriptionCVE.org

The Device Encryption Client component in Sophos SafeGuard Enterprise 6.0, when a volume-based encryption policy is enabled in conjunction with a user-defined key, does not properly block use of exFAT USB flash drives, which makes it easier for local users to bypass intended access restrictions and copy sensitive information to a drive via multiple removal and reattach operations.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-264. The Device Encryption Client component in Sophos SafeGuard Enterprise 6.0, when a volume-based encryption policy is enabled in conjunction with a user-defined key, does not properly block use of exFAT USB flash drives, which makes it easier for local users to bypass intended access restrictions and copy sensitive information to a drive via multiple removal and reattach operations. Affected products include: Sophos Safeguard Enterprise.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.