CVE-2018-6660: SB10228 ePO Directory Traversal vulnerability

Published Apr 2, 2018

Updated

Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.

Affected Software

4 affected components

McAfee ePolicy Orchestrator=5.3.0

McAfee ePolicy Orchestrator=5.3.1

McAfee ePolicy Orchestrator=5.3.2

McAfee ePolicy Orchestrator=5.9.0

Event History

Apr 2, 2018

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:29 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2018-6660?

CVE-2018-6660 has a severity rating that indicates a directory traversal vulnerability in specific versions of McAfee ePolicy Orchestrator.

How do I fix CVE-2018-6660?

To mitigate CVE-2018-6660, upgrade to the latest version of McAfee ePolicy Orchestrator that addresses this vulnerability.

Which versions of McAfee ePolicy Orchestrator are affected by CVE-2018-6660?

CVE-2018-6660 affects McAfee ePolicy Orchestrator versions 5.3.0, 5.3.1, 5.3.2, and 5.9.0.

What type of vulnerability is CVE-2018-6660?

CVE-2018-6660 is classified as a directory traversal vulnerability.

Can CVE-2018-6660 lead to unauthorized access?

Yes, CVE-2018-6660 could allow an attacker to bypass file extension restrictions, potentially leading to unauthorized access.