TrellixCVELIST:CVE-2018-6660CVE-2018-6660 SB10228 ePO Directory Traversal vulnerability
6.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:H
6.3 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
44.7%
Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.
CNA Affected
[
{
"product": "ePolicy Orchestrator (ePO)",
"vendor": "McAfee",
"versions": [
{
"status": "affected",
"version": "5.3.2"
},
{
"status": "affected",
"version": "5.3.1"
},
{
"status": "affected",
"version": "5.3.0"
},
{
"status": "affected",
"version": "5.9.0"
}
]
}
]Related
6.2 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:H
6.3 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
44.7%