PT-2013-2127 · Mcafee · Mcafee Epolicy Orchestrator

Jerome Nokin + 1 · Published 2013-05-01 · Updated 2017-11-16 · CVE-2013-0141

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:A/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator (ePO) versions prior to 4.5.7 McAfee ePolicy Orchestrator (ePO) versions 4.6.x prior to 4.6.6

Description A directory traversal issue allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel. This can be demonstrated by writing to the Software/ directory.

Recommendations For versions prior to 4.5.7, update to version 4.5.7 or later. For versions 4.6.x prior to 4.6.6, update to version 4.6.6 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-0141

Affected Products

Mcafee Epolicy Orchestrator

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-0141 · Security Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10042 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0141 · Note
• http://seclists.org/fulldisclosure/2014/Apr/289 · Note
• http://kb.cert.org/vuls/id/209131 · Note
• http://us-cert.gov/ncas/alerts/TA13-193A · Note