CVE-2015-8024: OS Command Injection
First published: Wed Dec 02 2015(Updated: )
McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) 9.3.x before 9.3.2MR19, 9.4.x before 9.4.2MR9, and 9.5.x before 9.5.0MR8, when configured to use Active Directory or LDAP authentication sources, allow remote attackers to bypass authentication by logging in with the username "NGCP|NGCP|NGCP;" and any password.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HP Enterprise Security Manager | =9.3.0 | |
| HP Enterprise Security Manager | =9.3.1 | |
| HP Enterprise Security Manager | =9.3.2 | |
| HP Enterprise Security Manager | =9.4.0 | |
| HP Enterprise Security Manager | =9.4.1 | |
| HP Enterprise Security Manager | =9.4.2 | |
| HP Enterprise Security Manager | =9.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-8024?
CVE-2015-8024 has a medium severity rating due to its impact on authentication mechanisms.
How do I fix CVE-2015-8024?
To fix CVE-2015-8024, upgrade to McAfee Enterprise Security Manager version 9.3.2MR19, 9.4.2MR9, or 9.5.0MR8 or later.
What products are affected by CVE-2015-8024?
CVE-2015-8024 affects McAfee Enterprise Security Manager (ESM), ESM/Log Manager, and ESM/Receiver versions prior to the specified updates.
Can CVE-2015-8024 lead to unauthorized access?
Yes, CVE-2015-8024 can allow remote attackers to bypass authentication when Active Directory or LDAP authentication sources are used.
Is there a workaround for CVE-2015-8024?
A recommended workaround for CVE-2015-8024 is to disable Active Directory or LDAP authentication until the software is updated.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/mcafee
- canonical/hp enterprise security manager
- version/hp enterprise security manager/9.3.0
- version/hp enterprise security manager/9.3.1
- version/hp enterprise security manager/9.3.2
- version/hp enterprise security manager/9.4.0
- version/hp enterprise security manager/9.4.1
- version/hp enterprise security manager/9.4.2
- version/hp enterprise security manager/9.5.0