Lucene search

TrellixCVELIST:CVE-2021-31831

HistoryJun 03, 2021 - 10:10 a.m.

CVE-2021-31831 Incorrect access to deleted scripts vulnerability in McAfee DBSec

2021-06-0310:10:11

CWE-552

trellix

www.cve.org

mcafee

database security

authentication

sql scripts

rest api

CVSS3

4.9

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

26.5%

JSON

Incorrect access to deleted scripts vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to gain access to signed SQL scripts which have been marked as deleted or expired within the administrative console. This access was only available through the REST API.

CNA Affected

[
  {
    "product": "McAfee Database Security (DBSec)",
    "vendor": "McAfee,LLC",
    "versions": [
      {
        "lessThan": "4.8.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

kc.mcafee.com/corporate/index?page=content&id=SB10359