CVE-2011-3007

Published Aug 10, 2011

Last updated 7 years ago

Overview

Description: The myCIOScn ActiveX control (myCIOScn.dll) in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter, as demonstrated by injecting script into a log file and executing arbitrary code using the MyCioScan.Scan.Start method.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:mcafee:saas_endpoint_protection:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2E4F4E19-908C-47AA-BFB3-68897247B310",
            "versionEndIncluding": "5.2.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References