CVE-2021-23894criticalCWE-502

CVE-2021-23894: falha crítica em McAfee Database Security (DBSec)

Unauthorized deserialization of untrusted data in McAfee DBSec

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar McAfee Database Security

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.6epss 2.2%
Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized object sent to the DBSec server.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
McAfee,LLC · McAfee Database Security (DBSec)
CVEs relacionadas — McAfee Database Security (DBSec)

No mesmo produto, das mais perigosas para as menos.

CVE-2021-23895CRITICALAuthorized deserialization of untrusted data in McAfee DBSecEPSS 1.9%CVE-2021-31850MEDIUMDenial of Service in Database Security on WindowsEPSS 1.0%CVE-2021-31831MEDIUMIncorrect access to deleted scripts vulnerability in McAfee DBSecEPSS 0.6%CVE-2021-31830MEDIUMCross site Scripting (XSS) vulnerability in McAfee DBSecEPSS 0.5%CVE-2021-23896LOWCleartext Transmission of Sensitive Information in McAfee DBSecEPSS 0.2%