7.6high
CVE-2018-6677
McAfee Web Gateway (MWG) - Directory Traversal vulnerability
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.6
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
2.1%
percentile 82%
Public exploits
0
none known
Summary
Directory Traversal vulnerability in the administrative user interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to gain elevated privileges via unspecified vectors.
Exploit prediction (EPSS)
2.14% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 7.6 | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| CNA | 3.0 | 7.6 | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Affected products
- McAfee McAfee Web Gateway (MWG)
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- securityfocus.com /bid/104893 · vdb-entry, x_refsource_BID, x_transferred
- kc.mcafee.com /corporate/index?page=content&id=SB10245 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-6677
- NVD: CVE-2018-6677
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.