PT-2018-17704 · Mcafee · Mcafee Web Gateway

Published 2018-06-26 · Updated 2019-10-09 · CVE-2018-6667

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions McAfee Web Gateway versions 7.8.1.0 through 7.8.1.5

Description The issue allows remote attackers to execute arbitrary code via Java management extensions (JMX) due to an Authentication Bypass vulnerability in the administrative user interface.

Recommendations For McAfee Web Gateway versions 7.8.1.0 through 7.8.1.5, consider disabling Java management extensions (JMX) until a patch is available to prevent remote attackers from executing arbitrary code.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-6667

Affected Products

Mcafee Web Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-6667 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6667 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10241 · Note
• http://securityfocus.com/bid/104564 · Note
• http://securitytracker.com/id/1041129 · Note