CVE-2017-4054
HighSummary
CVE-2017-4054 describes a command injection vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, and 3.4. Remote authenticated users can execute arbitrary commands via a crafted HTTP request parameter.
Risk Assessment
This vulnerability may allow unauthorized command execution on the server, posing a significant threat to the security of the system and the organization's data.
Recommendation
It is recommended to upgrade to the latest version of McAfee Advanced Threat Defense to mitigate this vulnerability and restrict access to the web interface to trusted users only.
Other vulnerabilities in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4
See all- CVE-2017-4057High
CVE-2017-4057 is a privilege escalation vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, 3.4, allowing remote authenticated users to gain elevated privileges via the GUI or GUI terminal commands.
- CVE-2017-4055High
Exploitation of an authentication vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users to bypass ATD detection via loose enforcement of authentication and authorization.
- CVE-2017-4053Critical
CVE-2017-4053 is a Command Injection vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, and 3.4. It allows remote unauthenticated users or attackers to execute arbitrary commands via a crafted HTTP request parameter.
- CVE-2017-4052Critical
CVE-2017-4052 is an authentication bypass vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4. Remote unauthenticated users can change or update configuration settings and gain administrator functionality via a crafted HTTP request parameter.
Original NVD description (English source)
Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to execute a command of their choice via a crafted HTTP request parameter.