Lucene search

MitreCVE-2011-3007

HistoryAug 10, 2011 - 8:55 p.m.

CVE-2011-3007

2011-08-1020:55:01

CWE-94

mitre

web.nvd.nist.gov

cve-2011-3007

mycioscn

activex control

mcafee

saas endpoint protection

remote attackers

arbitrary files

vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.2

Confidence

Low

EPSS

0.006

Percentile

79.3%

JSON

The myCIOScn ActiveX control (myCIOScn.dll) in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter, as demonstrated by injecting script into a log file and executing arbitrary code using the MyCioScan.Scan.Start method.

Affected configurations

Nvd

Node

mcafeesaas_endpoint_protectionRange≤5.2.1

VendorProductVersionCPE
mcafeesaas_endpoint_protection*cpe:2.3:a:mcafee:saas_endpoint_protection:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mcafee	saas_endpoint_protection	*	cpe:2.3:a:mcafee:saas_endpoint_protection::::::::

References

dvlabs.tippingpoint.com/advisory/TPTI-11-13

osvdb.org/74513

exchange.xforce.ibmcloud.com/vulnerabilities/69093

kc.mcafee.com/corporate/index?page=content&id=SB10016

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.2

Confidence

Low

EPSS

0.006

Percentile

79.3%

JSON

Related for CVE-2011-3007