PT-2019-2819 · Mcafee · Mcafee Enterprise Security Manager

CVE-2019-3630 · Publicado 2019-06-25 · Atualizado 2022-12-13

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions McAfee Enterprise Security Manager versions prior to 11.2.0 McAfee Enterprise Security Manager versions prior to 10.4.0

Description The issue allows an authenticated user to execute arbitrary code via specially crafted parameters. This is due to incorrect restriction of a directory path name with limited access. Exploitation of the issue may allow a remote attacker to elevate their privileges.

Recommendations For versions prior to 11.2.0, update to version 11.2.0 or later to resolve the issue. For versions prior to 10.4.0, update to version 10.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to specially crafted parameters to minimize the risk of exploitation.

Correção

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

BDU:2019-02776

CVE-2019-3630

Produtos afetados

Mcafee Enterprise Security Manager

Referências · 7

• https://t.me/cvenotify/39705 · Publicação no Telegram
• https://cxsecurity.com/cveshow/CVE-2019-3630 · Nota
• https://kc.mcafee.com/corporate/index?page=content&id=SB10284 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-3630 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-3630 · Aviso do Fabricante
• https://kc.mcafee.com/corporate/index?page=content&id=SB10284 · Nota
• https://bdu.fstec.ru/vul/2019-02776 · Nota de Segurança