Sign-up

ID

VAR-201807-2141


CVE

CVE-2018-6678


TITLE

McAfee Web Gateway MWG Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-008394

DESCRIPTION

Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to execute arbitrary commands via unspecified vectors. McAfee Web Gateway is prone to a privilege-escalation vulnerability and a remote code-execution vulnerability. Attackers can leverage these issues to gain elevated privileges or execute arbitrary commands within the context of the affected application. The product provides features such as threat protection, application control, and data loss prevention. The management interface in McAfee MWG 7.8.1.x version has a security vulnerability. An attacker could exploit this vulnerability to execute arbitrary code

Trust: 1.98

sources: NVD: CVE-2018-6678 // JVNDB: JVNDB-2018-008394 // BID: 104893 // VULHUB: VHN-136710

AFFECTED PRODUCTS

vendor:mcafeemodel:web gatewayscope:eqversion:7.8.1.0

Trust: 1.9

vendor:mcafeemodel:web gateway softwarescope:eqversion:7.8.1.x

Trust: 0.8

vendor:mcafeemodel:web gatewayscope:eqversion:7.8.1.6

Trust: 0.3

vendor:mcafeemodel:web gatewayscope:eqversion:7.8.1.5

Trust: 0.3

vendor:mcafeemodel:web gatewayscope:neversion:7.8.2

Trust: 0.3

sources: BID: 104893 // JVNDB: JVNDB-2018-008394 // CNNVD: CNNVD-201807-1766 // NVD: CVE-2018-6678

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-6678
value: CRITICAL

Trust: 1.0

trellixpsirt@trellix.com: CVE-2018-6678
value: LOW

Trust: 1.0

NVD: CVE-2018-6678
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201807-1766
value: CRITICAL

Trust: 0.6

VULHUB: VHN-136710
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-6678
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-136710
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-6678
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.3
impactScore: 6.0
version: 3.1

Trust: 1.0

trellixpsirt@trellix.com: CVE-2018-6678
baseSeverity: LOW
baseScore: 3.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: 1.7
impactScore: 1.4
version: 3.0

Trust: 1.0

NVD: CVE-2018-6678
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-136710 // JVNDB: JVNDB-2018-008394 // CNNVD: CNNVD-201807-1766 // NVD: CVE-2018-6678 // NVD: CVE-2018-6678

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-77

Trust: 0.9

sources: VULHUB: VHN-136710 // JVNDB: JVNDB-2018-008394 // NVD: CVE-2018-6678

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201807-1766

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201807-1766

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-008394

PATCH
title:SB10245url:https://kc.mcafee.com/corporate/index?page=content&id=SB10245
Trust: 0.8
title:McAfee Web Gateway Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=82574
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-008394 // 
            
            
            
            CNNVD: CNNVD-201807-1766

EXTERNAL IDS
db:NVDid:CVE-2018-6678
Trust: 2.8
db:MCAFEEid:SB10245
Trust: 2.0
db:BIDid:104893
Trust: 2.0
db:JVNDBid:JVNDB-2018-008394
Trust: 0.8
db:CNNVDid:CNNVD-201807-1766
Trust: 0.7
db:VULHUBid:VHN-136710
Trust: 0.1
sources:
            
            
            VULHUB: VHN-136710 // 
            
            
            
            BID: 104893 // 
            
            
            
            JVNDB: JVNDB-2018-008394 // 
            
            
            
            CNNVD: CNNVD-201807-1766 // 
            
            
            
            NVD: CVE-2018-6678

REFERENCES
url:https://kc.mcafee.com/corporate/index?page=content&id=sb10245
Trust: 1.9
url:http://www.securityfocus.com/bid/104893
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-6678
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-6678
Trust: 0.8
url:http://www.mcafee.com/
Trust: 0.3
url:https://kc.mcafee.com/corporate/index?page=content&id=sb10245
Trust: 0.1
sources:
            
            
            VULHUB: VHN-136710 // 
            
            
            
            BID: 104893 // 
            
            
            
            JVNDB: JVNDB-2018-008394 // 
            
            
            
            CNNVD: CNNVD-201807-1766 // 
            
            
            
            NVD: CVE-2018-6678

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 104893

SOURCES
db:VULHUBid:VHN-136710
db:BIDid:104893
db:JVNDBid:JVNDB-2018-008394
db:CNNVDid:CNNVD-201807-1766
db:NVDid:CVE-2018-6678

LAST UPDATE DATE
2024-11-23T21:52:56.799000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-136710date:2023-03-03T00:00:00
db:BIDid:104893date:2018-07-17T00:00:00
db:JVNDBid:JVNDB-2018-008394date:2018-10-16T00:00:00
db:CNNVDid:CNNVD-201807-1766date:2019-10-17T00:00:00
db:NVDid:CVE-2018-6678date:2024-11-21T04:11:05.757

SOURCES RELEASE DATE
db:VULHUBid:VHN-136710date:2018-07-23T00:00:00
db:BIDid:104893date:2018-07-17T00:00:00
db:JVNDBid:JVNDB-2018-008394date:2018-10-16T00:00:00
db:CNNVDid:CNNVD-201807-1766date:2018-07-23T00:00:00
db:NVDid:CVE-2018-6678date:2018-07-23T13:29:00.407