PT-2019-2817 · Mcafee · Mcafee Enterprise Security Manager

Published 2019-06-25 · Updated 2022-12-13 · CVE-2019-3632

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions McAfee Enterprise Security Manager versions prior to 11.2.0 McAfee Enterprise Security Manager versions prior to 10.4.0

Description The issue is related to a Directory Traversal vulnerability. It allows an authenticated user to gain elevated privileges via specially crafted input. The vulnerability exists due to incorrect restriction of the directory path name with limited access. Exploitation of the vulnerability may allow a remote attacker to elevate their privileges.

Recommendations For versions prior to 11.2.0, update to version 11.2.0 or later to resolve the issue. For versions prior to 10.4.0, update to version 10.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-02774

CVE-2019-3632

Affected Products

Mcafee Enterprise Security Manager

References · 8

• https://osv.dev/vulnerability/CVE-2019-3632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3632 · Security Note
• https://bdu.fstec.ru/vul/2019-02774 · Security Note
• https://vuldb.com/?id.137031 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10284 · Note
• https://cxsecurity.com/cveshow/CVE-2019-3632 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10284 · Note
• https://t.me/cvenotify/39707 · Telegram Post