CVE-2017-3980 — Path Traversal in Epolicy Orchestrator

CWE-22 — Path Traversal3 documents3 sources
Severity
7.2HIGHNVD
EPSS
3.4%
top 12.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mcafee Epolicy Orchestrator
Timeline
PublishedMay 18
Latest updateMay 14

Description

A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice via an authenticated ePO session.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDmcafee/epolicy_orchestrator5.3.0 — 5.3.3+2
▶CVEListV5mcafee/epolicy_orchestrator5.1.3 and earlier, 5.3.2 and earlier, 5.9.0 and earlier+2

🔴Vulnerability Details

2
GHSA
GHSA-8ph5-f876-gj9r: A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5↗2022-05-14
▶
CVEList
CVE-2017-3980: A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5↗2017-05-18
▶
CVE-2017-3980 — Path Traversal in Mcafee | cvebase