CVE-2021-23885
Assigner: trellix
Published: 2021-02-17T09:20:14
State: PUBLISHED
affected: product: McAfee Web Gateway (MWG)
vendor: McAfee,LLC
versions: lessThan: 9.2.8
status: affected
version: unspecified
versionType: custom
descriptions: value: Privilege escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.8 allows an authenticated user to gain elevated privileges through the User Interface and execute commands on the appliance via incorrect improper neutralization of user input in the troubleshooting page.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-269
description: CWE-269: Improper Privilege Management 
type: CWE
source: discovery: EXTERNAL
title: Privilege escalation vulnerability in McAfee Web Gateway (MWG) UI
x_generator: engine: Vulnogram 0.0.9