SB2018072325 - Multiple vulnerabilities in McAfee Web Gateway

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Path traversal (CVE-ID: CVE-2018-6677)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the administrative user interface in McAfee Web Gateway (MWG) MWG 7.8.1.x. A remote authenticated attacker can send a specially crafted HTTP request and authenticated administrator users to gain elevated privileges via unspecified vectors.

2) Input validation error (CVE-ID: CVE-2018-6678)

The vulnerability allows a remote privileged user to execute arbitrary code.

Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to execute arbitrary commands via unspecified vectors.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://www.securityfocus.com/bid/104893
• https://kc.mcafee.com/corporate/index?page=content&id=SB10245