CVE-2018-6670

External Entity Attack vulnerability in the ePO extension in McAfee Common UI (CUI) 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter.

CVSS v3 7.6 HIGH
CVSS v2.0 4.0 MEDIUM

7.6^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L

Exploitability : 2.3 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://kc.mcafee.com/corporate/index?page=content&id=SB10236
https://kc.mcafee.com/corporate/index?page=content&id=SB10236

Configurations

Configuration 1 (hide)

cpe:2.3:a:mcafee:common_catalog:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-06-07 18:29

Updated : 2024-11-21 04:11

NVD link : CVE-2018-6670

Mitre link : CVE-2018-6670

CVE.ORG link : CVE-2018-6670

JSON object : View

Products Affected

mcafee

common_catalog

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2018-6670", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "trellixpsirt@trellix.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2018-06-07T18:29:00.250", "references": [{"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10236", "source": "trellixpsirt@trellix.com"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10236", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "External Entity Attack vulnerability in the ePO extension in McAfee Common UI (CUI) 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter."}, {"lang": "es", "value": "Vulnerabilidad de ataque de entidad externa en la extensi\u00f3n ePO en McAfee Common UI (CUI) 2.0.2 permite que usuarios remotos autenticados vean informaci\u00f3n confidencial mediante un par\u00e1metro de petici\u00f3n HTTP manipulado."}], "lastModified": "2024-11-21T04:11:05.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:common_catalog:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F849CD40-0536-486F-8384-7066E55A651D", "versionEndExcluding": "2.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "trellixpsirt@trellix.com"}