CVE ID | |
CVSS SCORE | 7.8, AV:N/AC:L/Au:N/C:C/I:N/A:N |
AFFECTED VENDORS |
McAfee |
AFFECTED PRODUCTS |
Cloud Identity Manager |
VULNERABILITY DETAILS |
The specific flaw exists within a servlet called ExtensionAccessServlet which contains a directory traversal vulnerability inside the path info string of a GET request. A remote attacker can leverage this vulnerability to read arbitrary files from the underlying OS with SYSTEM privileges. |
ADDITIONAL DETAILS |
McAfee has issued an update to correct this vulnerability. More details can be found at:
https://kc.mcafee.com/corporate/index?page=content&id=SB10066 |
DISCLOSURE TIMELINE |
|
CREDIT | Andrea Micalizzi aka rgod |