McAfee ePolicy Orchestrator CVE-2017-3980 Directory Traversal Vulnerability
BID:98559
Info
McAfee ePolicy Orchestrator CVE-2017-3980 Directory Traversal Vulnerability
| Bugtraq ID: | 98559 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-3980 |
| Remote: | Yes |
| Local: | No |
| Published: | May 18 2017 12:00AM |
| Updated: | May 18 2017 12:00AM |
| Credit: | Christoffer Wiman |
| Vulnerable: |
McAfee ePolicy Orchestrator 5.9 McAfee ePolicy Orchestrator 5.1.2 McAfee ePolicy Orchestrator 5.1.1 McAfee ePolicy Orchestrator 5.1 McAfee ePolicy Orchestrator 5.3.2 McAfee ePolicy Orchestrator 5.3.1 McAfee ePolicy Orchestrator 5.3.0 McAfee ePolicy Orchestrator 5.1.3 |
| Not Vulnerable: | |
Discussion
McAfee ePolicy Orchestrator CVE-2017-3980 Directory Traversal Vulnerability
McAfee ePolicy Orchestrator is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue using directory-traversal characters ('../') to access or read arbitrary files that contain sensitive information or to access files outside of the restricted directory to obtain sensitive information and perform other attacks.
The following products are affected:
McAfee ePolicy Orchestrator 5.1.3 and prior
McAfee ePolicy Orchestrator 5.3.2 and prior
McAfee ePolicy Orchestrator 5.9.0 and prior
McAfee ePolicy Orchestrator is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit this issue using directory-traversal characters ('../') to access or read arbitrary files that contain sensitive information or to access files outside of the restricted directory to obtain sensitive information and perform other attacks.
The following products are affected:
McAfee ePolicy Orchestrator 5.1.3 and prior
McAfee ePolicy Orchestrator 5.3.2 and prior
McAfee ePolicy Orchestrator 5.9.0 and prior
Exploit / POC
McAfee ePolicy Orchestrator CVE-2017-3980 Directory Traversal Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
McAfee ePolicy Orchestrator CVE-2017-3980 Directory Traversal Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
McAfee ePolicy Orchestrator CVE-2017-3980 Directory Traversal Vulnerability
References:
References:
- ePolicy Orchestrator Homepage (Network Associates Inc.)
- McAfee Homepage (McAfee)
- SB10196: ePolicy Orchestrator update fixes directory traversal vulnerability (CV (McAfee)