Lucene search

TrellixCVELIST:CVE-2021-23885

HistoryFeb 17, 2021 - 9:20 a.m.

CVE-2021-23885 Privilege escalation vulnerability in McAfee Web Gateway (MWG) UI

2021-02-1709:20:14

CWE-269

trellix

www.cve.org

cve-2021-23885

privilege escalation

mcafee web gateway

user interface

input neutralization.

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

40.1%

JSON

Privilege escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.8 allows an authenticated user to gain elevated privileges through the User Interface and execute commands on the appliance via incorrect improper neutralization of user input in the troubleshooting page.

CNA Affected

[
  {
    "product": "McAfee Web Gateway (MWG)",
    "vendor": "McAfee,LLC",
    "versions": [
      {
        "lessThan": "9.2.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

kc.mcafee.com/corporate/index?page=content&id=SB10349

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

40.1%

JSON

Related for CVELIST:CVE-2021-23885