CVE-2017-4053
CriticalSummary
CVE-2017-4053 is a Command Injection vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, and 3.4. It allows remote unauthenticated users or attackers to execute arbitrary commands via a crafted HTTP request parameter.
Risk Assessment
This vulnerability poses a significant risk to organizations as it allows attackers to remotely execute commands on the server, potentially leading to data loss or system compromise.
Recommendation
It is recommended to upgrade to the latest version of McAfee Advanced Threat Defense and implement appropriate security measures to restrict access to the web interface.
Other vulnerabilities in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4
See all- CVE-2017-4057High
CVE-2017-4057 is a privilege escalation vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, 3.4, allowing remote authenticated users to gain elevated privileges via the GUI or GUI terminal commands.
- CVE-2017-4055High
Exploitation of an authentication vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users to bypass ATD detection via loose enforcement of authentication and authorization.
- CVE-2017-4054High
CVE-2017-4054 describes a command injection vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, and 3.4. Remote authenticated users can execute arbitrary commands via a crafted HTTP request parameter.
- CVE-2017-4052Critical
CVE-2017-4052 is an authentication bypass vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4. Remote unauthenticated users can change or update configuration settings and gain administrator functionality via a crafted HTTP request parameter.
Original NVD description (English source)
Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to execute a command of their choice via a crafted HTTP request parameter.