Lucene search

TrellixCVELIST:CVE-2021-23894

HistoryJun 02, 2021 - 1:05 p.m.

CVE-2021-23894 Unauthorized deserialization of untrusted data in McAfee DBSec

2021-06-0213:05:15

CWE-502

trellix

www.cve.org

cve-2021-23894

mcafee database security

untrusted data

CVSS3

9.6

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.008

Percentile

81.1%

JSON

Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized object sent to the DBSec server.

CNA Affected

[
  {
    "product": "McAfee Database Security (DBSec)",
    "vendor": "McAfee,LLC",
    "versions": [
      {
        "lessThan": "4.8.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

kc.mcafee.com/corporate/index?page=content&id=SB10359

CVSS3

9.6

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.008

Percentile

81.1%

JSON

Related for CVELIST:CVE-2021-23894