Lucene search

TrellixCVELIST:CVE-2021-23895

HistoryJun 02, 2021 - 1:05 p.m.

CVE-2021-23895 Authorized deserialization of untrusted data in McAfee DBSec

2021-06-0213:05:20

CWE-502

trellix

www.cve.org

deserialization

vulnerability

mcafee dbsec

remote shell

java serialized object

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

54.3%

JSON

Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized object sent to the DBSec server.

CNA Affected

[
  {
    "product": "McAfee Database Security (DBSec)",
    "vendor": "McAfee,LLC",
    "versions": [
      {
        "lessThan": "4.8.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

kc.mcafee.com/corporate/index?page=content&id=SB10359

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

54.3%

JSON

Related for CVELIST:CVE-2021-23895