PT-2011-4245
CVE-2011-3007
·
تاريخ النشر
2011-08-10
·
تاريخ التحديث
2017-08-29
الوصف من
CVSS 2.0
6.8
متوسطةالمقاييسAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
McAfee SaaS Endpoint Protection versions 5.2.1 and earlier
Description
The issue allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the
MyCioScan.Scan.ReportFile parameter. This can be used to inject script into a log file and execute arbitrary code using the MyCioScan.Scan.Start method.Recommendations
For McAfee SaaS Endpoint Protection versions 5.2.1 and earlier, consider restricting access to the
MyCioScan.Scan.ReportFile parameter to prevent arbitrary file writing. As a temporary workaround, avoid using the MyCioScan.Scan.Start method until a fix is available. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾