CVE-2018-6660

Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.2 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:H
trellixCNA
6.2 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
VendorProductVersion
mcafeeepolicy_orchestrator
5.3.0
mcafeeepolicy_orchestrator
5.3.1
mcafeeepolicy_orchestrator
5.3.2
mcafeeepolicy_orchestrator
5.9.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/103392
http://www.securitytracker.com/id/1040884
https://kc.mcafee.com/corporate/index?page=content&id=SB10228
http://www.securityfocus.com/bid/103392
http://www.securitytracker.com/id/1040884
https://kc.mcafee.com/corporate/index?page=content&id=SB10228