Vulnerability identifier: #VU12136

Vulnerability risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-6660

CWE-ID: CWE-22

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
McAfee ePolicy Orchestrator
Server applications / Directory software, identity management

Vendor: McAfee

Description
The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.

The weakness exists due to path traversal. An adjacent attacker can export a specially crafted XML file, use Windows alternate data streams, bypass the file extensions via improper validation of the path and gain access to potentially sensitive information.

Mitigation
Update to versions 5.3.3 or 5.9.1.

Vulnerable software versions

McAfee ePolicy Orchestrator: 5.3.0 - 5.9.0

---

External links
http://kc.mcafee.com/corporate/index?page=content&id=SB10228

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.