PT-2017-5764 · Mcafee · Mcafee Saas Control Console (Scc) Platform

Published 2017-03-14 · Updated 2017-03-29 · CVE-2013-7462

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: McAfee SaaS Control Console (SCC) Platform versions 6.14 through 6.14 before patch 1070 McAfee SaaS Control Console (SCC) Platform versions 6.15 through 6.15 before patch 1076

Description: A directory traversal issue in the web application allows unauthenticated users to view the contents of arbitrary system files without file system level read access restrictions. This is achieved through a null-byte injection exploit.

Recommendations: For McAfee SaaS Control Console (SCC) Platform version 6.14, apply patch 1070 to resolve the issue. For McAfee SaaS Control Console (SCC) Platform version 6.15, apply patch 1076 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-7462

Affected Products

Mcafee Saas Control Console (Scc) Platform

References · 2

• https://kc.mcafee.com/corporate/index?page=content&id=SB10056 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7462 · Security Note